微信读书伴侣

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:13 AM UTC
• Version: 1.1.0

Overview

This WeRead helper is coherent, but it needs Review because it can use your WeRead API key for broad authenticated API calls and exports private reading data with limited guardrails.

Install only if you are comfortable giving the skill access to your WeRead API key, reading history, bookshelf metadata, private highlights, and thoughts. Avoid using the generic weread_call.py helper unless you know the endpoint is safe, review export paths carefully, and verify the external weread-skills ZIP through a trusted channel before installing it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/weread_call.py:29

Finding

Unrestricted Authenticated WeRead Gateway Caller

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned and Unverified Remote Skill Dependency

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/workflows.md (reported line 8)May include surrounding context.

md

- `weread-skills`: official API documentation and endpoint semantics. Required dependency, installed from `https://cdn.weread.qq.com/skills/weread-skills.zip`.
- `weread-plus`: orchestration, analysis, exports, recommendations, and privacy-safe presentation.

Do not edit `weread-skills`. If official docs and this skill conflict, trust the official skill for endpoint fields and update this skill later.

## Decision Tree

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs use of local scripts, environment variables, file reads/writes, and network access, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization ambiguity where an agent may invoke broader capabilities than users expect, increasing the risk of unintended access to local files, secrets such as WEREAD_API_KEY, or remote endpoints during normal skill execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables implicit invocation without any trigger phrases or scope constraints, which can cause the agent to activate this skill in response to broad or ambiguous user requests. Because this skill chains enhanced workflows on top of another installed skill and may access reading-history-related functions, unintended invocation could expose user data, perform unwanted actions, or influence responses when the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow allows exporting personal notes to an arbitrary user-specified file path without any privacy or path-safety guidance. Because the exported content contains personal highlights and thoughts, this can lead to accidental disclosure, overwriting sensitive files, or writing data into shared/synced locations if the surrounding agent executes the command naively.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/weread_common.py (reported line 20)May include surrounding context.

python

GATEWAY_URL = "https://i.weread.qq.com/api/agent/gateway"
DEFAULT_OFFICIAL_SKILL_DIR = Path("~/.codex/skills/weread-skills").expanduser()
FALLBACK_SKILL_VERSION = "1.0.3"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The generated natural-language output strings in the analysis and markdown rendering are consistently fixed to Chinese, including summaries, headings, warnings, and reading prompts. This forces a specific language/locale on users without any opt-in or configuration path, which matches the policy-violation criterion for language constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script calls remote WeRead API endpoints to retrieve bookmarks and personal reviews, which necessarily transmits identifiers and accesses private user data. The file contains no confirmation prompt, user-facing log, or warning comment explaining that it will contact a remote service and process personal account data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This script exports a user's personal WeRead highlights and thoughts either to stdout or to a file, but it does not provide any explicit warning, confirmation, or privacy notice before disclosing potentially sensitive reading history and annotations. In the context of a note-export skill, this creates a real privacy risk because users may unknowingly print private content into shared terminals, logs, chat transcripts, or insecure files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown report includes sensitive bookshelf metadata such as whether books are marked private, counts of private items, recent reading activity, and titles/authors of recently read books. In a reporting/export skill, this can leak intimate reading habits if the output is shown, logged, or shared without an explicit warning or consent step, especially because the skill description includes personal note export and reading reports where disclosure is plausible.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated markdown headings and labels are hard-coded in Chinese, which imposes a specific language on all users regardless of preference. This is a natural-language policy concern unless the tool is explicitly documented as Chinese-only or offers opt-in locale selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated markdown headings and labels are fixed in Chinese, and the script provides no option for users to select another language or opt into this locale. This is a natural-language policy concern because the skill forces a specific language in user-facing output without offering a choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The generated markdown output uses fixed Chinese headings and labels such as '公开书评', '概览', '评论', '作者', and '日期'. Because the script does not provide any user opt-in or locale selection, it imposes a specific language on all users, which matches the language/locale policy violation criterion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.