微信读书伴侣

• Outcome: Pass
• Latest audit: Jun 22, 2026 · 4:37 PM UTC
• Version: 1.1.0

Overview

This WeRead companion skill handles private reading data, but its network use, API key use, exports, and reports are disclosed and aligned with its reading-analysis purpose.

Install only if you are comfortable giving the skill access to your WeRead API key and reading history. Treat note exports and shelf reports as private files, choose output paths carefully, and avoid sharing generated reports unless you have reviewed them for personal highlights, private books, and public-review identifiers.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs use of environment secrets (`WEREAD_API_KEY`), local filesystem paths, file export/write operations, and network access to external endpoints and downloadable dependencies, yet no explicit permissions are declared. This creates a permission-transparency gap: users and the hosting platform may not realize the skill can read secrets, access local files, write exports, and contact remote services, increasing the risk of overbroad access or misuse if the skill or its dependencies are modified.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables implicit invocation with no trigger constraints or exclusion conditions, which can cause the agent to activate this skill in broader contexts than the user intended. Because this skill is designed to operate on top of another installed skill and can influence recommendation, export, and analysis workflows, over-broad auto-invocation increases the chance of unintended data access, unexpected actions, or prompt-routing abuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This script exports a user's personal highlights, notes, and thoughts and can write them directly to an arbitrary output path without any privacy warning, confirmation, or safer default handling. In the context of a reading companion skill, these exports may contain sensitive intellectual interests, annotations, opinions, or other private data, so silent persistence to disk increases the risk of unintended disclosure via shared machines, synced folders, logs, or later exfiltration by other tools.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: When --shelf is enabled, the report includes sensitive bookshelf metadata such as whether books are marked private, recently read titles, reading update dates, and private/public counts, and the markdown output explicitly labels items as 私密. In a reporting/export skill, this can leak a user's reading habits and privacy preferences to logs, downstream tools, or unintended recipients without any explicit confirmation or redaction step.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script collects and outputs public-review author metadata including stable identifiers (`userVid`) and avatars, and it also exposes raw API response data for single-review lookups. Even if the underlying content is public, repackaging identifiers and linking them to reading activity lowers friction for profiling, correlation, and bulk harvesting of user data in a way users may not expect.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.