Weakpass

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 1.0.0

Overview

The skill is coherent, but it handles password-related data through an external service and includes a curl pattern that could be unsafe if user input is pasted into it directly.

Review before installing in environments with real credentials or sensitive hash material. Use it only for authorized password-auditing work, avoid submitting production secrets unless policy allows it, and prefer URL-encoded structured HTTP calls over direct shell string substitution for generated wordlists.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:145

Finding

Unsanitized Word Interpolation May Enable Shell Command Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 145–166
Vulnerability Type: Shell command injection through unsafe URL construction
Risk Level: High

Vulnerable Code

markdown

## Generating Wordlists

Generate wordlist for a certain words based on specific hashcat rules

Required args:

- word: the word to generate a wordlist on using the specified hashcat rules

- set: [
  "online.rule", "top_3000.rule", "top_1500.rule", "top_750.rule", "top_500.rule", "top_250.rule", 
  "nsa_64.rule", "numbers.rule", "numbers100.rule", "years_1900_2025.rule", "years.rule", "symbols.rule"
  ]

- type: ["txt", "json"]


Generate a wordlist of the word "myword" with a rule set "online.rule" using type "txt":
```bash
curl -X 'GET' 'https://weakpass.com/api/v1/generate/myword?set=online.rule&type=txt' -H 'accept: text/plain'

Technical Analysis

The skill directs an agent to insert a user-supplied word into a URL contained within a single-quoted shell argument. Unlike the hash and prefix parameters elsewhere in the skill, the word parameter has no documented character validation, encoding requirement, or length restriction.

If an agent implements the instruction through direct textual substitution, a word containing a single quote can terminate the quoted URL. Shell control operators in the remaining input can then introduce additional commands. Merely surrounding the URL with single quotes is insufficient when untrusted input can itself contain a single quote.

The skill is documentation-only, so exploitation depends on an agent constructing and executing the demonstrated curl command through unsafe substitution. The dangerous construction pattern is nevertheless presented as the operational interface.

Attack Path

1. An attacker asks the agent to generate a wordlist for a crafted word containing a quote, shell separator, command, and comment marker.
2. For example, the supplied ...[truncated 1162 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not construct shell commands by replacing placeholders in command strings.
2. Use an HTTP client that accepts the URL, path components, and query parameters as separate structured values.
3. Percent-encode the word path component according to RFC 3986 before adding it to the request URL.
4. Define and enforce explicit validation rules for the word, including permitted characters and a reasonable maximum length. Reject unsupported input rather than attempting ad hoc escaping.
5. Validate set and type against the documented fixed allowlists.
6. If curl must be used, invoke it through an argument-array API without a shell and pass each option as a distinct argument.
7. Update the skill documentation to require safe encoding and provide an implementation example that cannot interpret user input as shell syntax.
8. Add tests covering quotes, semicolons, command substitutions, newlines, spaces, slashes, percent signs, and other shell or URL metacharacters.
9. Run the agent under least privilege with restricted filesystem and network access to reduce the impact of any command-construction failure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to submit hashes, prefixes, and candidate words directly to the third-party Weakpass API but does not clearly warn that this data leaves the local environment. In many contexts, hashes and password-derived material are sensitive authentication artifacts, and sending them to an external service can leak secrets, enable correlation of user activity, or violate organizational policy and compliance requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.