T08 · Insecure Dependencies
Warning
- Location
SKILL.md:23- Finding
Unpinned Third-Party Dependencies Allow Supply-Chain Substitution
- Content
View full analysis
- Remediation
View remediation
Security audit
Wikimind Skill
Security checks for vulnerabilities and agentic risk
Overview
This skill transparently saves selected content into a local WikiMind knowledge base, but users should be careful about what they persist and how they install its tools.
Install this only if you want the agent to persist selected content into a local searchable wiki. Before each ingest, confirm the exact content, title, domain, and file path; avoid storing secrets or confidential text; prefer the scoped MCP tool over raw shell/file writes; and install qmd/clawhub from trusted, pinned versions where possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:102- Finding
Unsafe Shell Logging Template Can Enable Command Injection
- Content
View full analysis
> "$WIKIMIND_ROOT//log.md" ``` ``` ### Technical Analysis The logging instruction presents the page title and domain as placeholders inside a shell command. These values can originate from content being ingested or from agent classification. If an implementation replaces the placeholders through direct string interpolation, shell metacharacters embedded in a malicious title or domain can be interpreted by the shell. Double quotes do not prevent command substitution using `$()` or backticks. A domain substituted into the redirection path can likewise introduce command substitution before the shell resolves the destination. Quoting the overall string therefore does not make arbitrary interpolated content safe. The documented command currently contains literal placeholders rather than executable variable expansion, so exploitation depends on the agent or downstream implementation translating those placeholders into untrusted values without safe argument handling. Nevertheless, the instruction encourages construction of a shell command from content-derived metadata and provides no validation requirements. ### Attack Path 1. An attacker supplies content with a crafted title or domain containing shell substitution syntax or other metacharacters. 2. The skill classifies the content and uses the attacker-controlled value as the page title or domain. 3. An agent or implementation replaces `Page Title` or `` directly in the documented shell command. 4. The generated command is passed to a shell. 5. The shell evaluates the injected syntax while appending the log entry, executing commands with the agent process's pr ...[truncated 436 chars]- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
The skill is explicitly designed to persist session-provided content by writing Markdown pages, updating a searchable BM25 index, and logging the operation. This creates a real privacy and data-retention risk: users may unintentionally store sensitive prompts, personal data, or confidential source material, after which future agent queries will retrieve that data from the local knowledge base. In this skill context, persistence is the core feature, which makes the risk expected but still security-relevant.
- Content
md 1. Read your wiki's schema to understand the domain structure 2. Classify the content (`concept` / `entity` / `comparison` / `source-summary`) 3. Write a properly formatted Markdown page with frontmatter 4. Update the BM25 search index 5. Log the operation
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Several trigger phrases such as 'add to knowledge base' and 'save to wiki' are broad, natural-language phrases that can easily occur in ordinary conversation. In a voice or chat-driven agent environment, this can cause accidental invocation and unintended persistence of sensitive user content into a local knowledge base, especially because the skill writes pages, updates an index, and logs operations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description encourages activation from very broad natural-language requests such as adding content to a knowledge base, which can overlap with ordinary conversation and cause unintended triggering. Because this skill performs persistent writes to a local knowledge base, accidental activation can silently store sensitive or irrelevant user content and alter local state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README states that the skill will write pages, update the BM25 index, and log operations, but it does not prominently warn users that these are persistent modifications to local knowledge storage. Lack of clear disclosure increases the risk that users trigger the skill without understanding that data will be retained, indexed, and made retrievable later.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
npx clawhub@latest install wikimind-ingest
手动安装
cp SKILL.md ~/.catpaw/skills/wiki-ingest/SKILL.md
text ---
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
npx clawhub@latest install wikimind-ingest
手动安装
cp SKILL.md ~/.catpaw/skills/wiki-ingest/SKILL.md
text ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The listed trigger phrases include generic expressions like 'store this' and 'save to wiki' in both Chinese and English, without contextual constraints. In a chat environment, such broad phrases raise the chance of false activation and unauthorized or accidental persistence of content into the knowledge base.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The metadata description embeds broad natural-language triggers such as 'add to knowledge base', 'save to wiki', and 'store this', which can cause the skill to activate on ordinary conversation rather than a clearly delimited command. Because this skill performs persistent local writes, accidental activation can lead to unintended ingestion of sensitive or irrelevant content into the user's knowledge base.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The dedicated trigger section further reinforces ambiguous activations in both English and Chinese, including phrases like 'Store this note' and 'Save to wiki' that may appear in normal user dialogue. In the context of a write-capable skill, ambiguous activation increases the chance of unintentional file creation, content persistence, and logging without the user's fully informed intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow instructs direct file writes, index updates, and log appends under $WIKIMIND_ROOT, but does not provide an explicit warning that the skill will modify local files persistently. This is dangerous because users may not realize that invoking the skill can create or alter knowledge-base content and logs, potentially storing sensitive data or enabling prompt-influenced content to be written to disk.
- Content
Static analysis
No suspicious patterns detected.