Security audit

Code Wiki

Security checks for vulnerabilities and agentic risk

Overview

The skill’s behavior matches its stated documentation-generation purpose, with clear user confirmation required before cloning, rendering, or serving.

Install only if you trust the external CodeWiki CLI and the runtime package registries used for rendering. Confirm the repository URL and output directory carefully, avoid --force on important folders, and use the preview server only when you expect a foreground localhost process.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: scripts/render_mkdocs.py:68
Finding: Runtime Installation and Execution of Unverified Third-Party Dependencies
Content: View full analysis
None: py = venv_python(venv_path) cmd = [ str(py), "-m", "pip", "install", "--index-url", PIP_INDEX_URL, "--trusted-host", PIP_TRUSTED_HOST, "--disable-pip-version-check", "--no-cache-dir", *REQUIREMENTS, ] print("[render_mkdocs] Installing dependencies (Aliyun mirror):") for req in REQUIREMENTS: print(f" - {req}") try: subprocess.run(cmd, check=True) except subprocess.CalledProcessError as exc: fail( f"pip install failed (exit={exc.returncode}). " f"Command: {' '.join(cmd)}", code=3, ) ``` ```javascript const NPM_REGISTRY = "https://registry.npmmirror.com"; const DEPENDENCIES = { "vitepress": "^1.5.0", "vitepress-plugin-mermaid": "^2.0.17", "mermaid": "^11.4.1", "vue": "^3.5.13", }; ``` ```javascript function npmInstall(workDir, cleanNode) { const nodeModules = join(workDir, "node_modules"); if (existsSync(nodeModules)) { if (cleanNode) { info(`Removing existing node_modules at ${nodeModules}`); rmSync(nodeModules, { recursive: true, force: true }); } else { info(`Reusing existing node_modules at ${nodeModules}`); return; } } const args = [ "install", "--registry", NPM_REGISTRY, "--no-audit", "--no-fund", "--loglevel", "error", ]; info(`Running: npm ${args.join(" ")} (cwd=${ ...[truncated 2922 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/render_mkdocs.py:493
Finding: Caller-Controlled Output Paths Can Be Recursively Deleted
Content: View full analysis
None: args = parse_args() src: Path = args.src.expanduser().resolve() out: Path = args.out.expanduser().resolve() if not src.exists(): fail(f"Source directory does not exist: {src}", code=1) if not src.is_dir(): fail(f"Source path is not a directory: {src}", code=1) if out.exists() and any(out.iterdir()): if not args.force: fail( f"Output directory is not empty: {out}. " "Re-run with --force to overwrite.", code=1, ) print(f"[render_mkdocs] Removing existing output directory: {out}") shutil.rmtree(out) out.mkdir(parents=True, exist_ok=True) ``` ```javascript function main() { const opts = parseArgs(); const src = resolve(opts.src); const out = resolve(opts.out); if (!existsSync(src)) fail(`Source directory does not exist: ${src}`); if (!statSync(src).isDirectory()) fail(`Source path is not a directory: ${src}`); if (existsSync(out) && readdirSync(out).length > 0) { if (!opts.force) { fail( `Output directory is not empty: ${out}. Re-run with --force to overwrite.`, ); } info(`Removing existing output directory: ${out}`); rmSync(out, { recursive: true, force: true }); } mkdirSync(out, { recursive: true }); ``` ### Technical Analysis Both standalone rendering scripts resolve a caller-supplied output path and recursively remove the entire resolved directory when `--force` is enabled. They do not reject dangerous targets such as the filesystem root, the user's home directory, the source directory, an ancestor of the source directory, or an unrelated directory containing user data. The normal `scripts/codewiki.sh ...[truncated 1411 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/render_docs.sh:328
Finding: Predictable Preview Log Files in Shared Temporary Directory
Content: View full analysis
/tmp/render_docs_${label}.log 2>&1 ) & SERVE_PIDS+=("$!") done log "Open any URL above in your browser. Press Ctrl-C to stop the server(s)." wait fi fi ``` ### Technical Analysis Preview server output is redirected to fixed, predictable filenames under the shared `/tmp` directory: - `/tmp/render_docs_mkdocs.log` - `/tmp/render_docs_vitepress.log` The script does not securely create these files, verify their type or ownership, or place them in a private temporary directory. On systems where local symlink protections do not prevent the operation, another local user can pre-create one of these paths as a symbolic link to a file writable by the victim. Shell redirection may then follow the link and truncate the target when the preview server starts. Concurrent invocations also share the same filenames, allowing runs to overwrite or mix their logs. ### Attack Path 1. A local attacker predicts which renderer the victim will serve. 2. The attacker creates the corresponding `/tmp/render_docs_*.log` path, potentially as a symbolic link to a victim-writable target. 3. The victim starts the Skill's preview server. 4. The shell opens the predictable path for output redirection before executing `python3 -m http.server`. 5. If platform protections permit symlink following, the link ...[truncated 534 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This second mismatch finding points to the same core issue: the skill advertises cloning, codewiki generation, VitePress support, and HTTP preview, but the detected behavior omits major parts of that contract. Such discrepancies can cause an agent or operator to approve execution under false assumptions, which is a security-relevant integrity problem even if not directly malicious.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This second mismatch finding points to the same core issue: the skill advertises cloning, codewiki generation, VitePress support, and HTTP preview, but the detected behavior omits major parts of that contract. Such discrepancies can cause an agent or operator to approve execution under false assumptions, which is a security-relevant integrity problem even if not directly malicious.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes operations that require shell execution, filesystem writes, and access to environment-dependent binaries, but it declares no explicit tool scope or permission boundaries. In an agent framework, that omission can let the skill run with broader-than-necessary capabilities, increasing the blast radius if the repository, arguments, or downstream tools behave unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language trigger is broad enough to activate on ordinary requests to generate documentation, which can cause the agent to initiate a workflow with network, disk, and long-running side effects when the user did not specifically intend that skill. In this context, over-triggering is more dangerous because the skill may clone remote repositories and start local servers.
Content: No source excerpt is available for this finding.

Unsafe Defaults

Medium

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
Content: Scanner excerpt · scripts/render_docs.sh (reported line 74)May include surrounding context.
sh
VITEPRESS_OUT="${REPO_ROOT}/vitepress" STACK="both" FORCE=0 CLEAN_SANDBOX=0 SERVE=0 SERVE_PORT=8000

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 84% confidence
Finding: The script installs packages over the network from a hard-coded third-party mirror and explicitly disables normal TLS host verification safeguards with --trusted-host. In an agent skill that automatically bootstraps and executes tooling, this expands the supply-chain trust boundary: if the mirror or network path is compromised, malicious packages could be installed and then executed during the build process.
Content: Scanner excerpt · scripts/render_mkdocs.py (reported line 240)May include surrounding context.
python
for req in REQUIREMENTS: print(f" - {req}") try: subprocess.run(cmd, check=True) except subprocess.CalledProcessError as exc: fail( f"pip install failed (exit={exc.returncode}). "

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated configuration sets theme.language: zh, which forces a specific locale for all rendered sites. This is a natural-language policy concern because the script does not offer a language choice or clearly limit itself to a China-specific or Chinese-only documentation context.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 91% confidence
Finding: This command runs mkdocs against documentation copied from an arbitrary source tree, after installing plugins that will process that content. In the context of an agent skill that may operate on untrusted repositories, building docs can trigger unsafe behavior in third-party plugins or dependency code, making this an indirect code-execution/supply-chain risk rather than a classic command-injection issue.
Content: Scanner excerpt · scripts/render_mkdocs.py (reported line 465)May include surrounding context.
python
cmd.extend(["--site-dir", str(site_dir)]) print(f"[render_mkdocs] Running: {' '.join(cmd)} (cwd={work})") try: subprocess.run(cmd, check=True, cwd=str(work)) except subprocess.CalledProcessError as exc: fail( f"mkdocs build failed (exit={exc.returncode}). "

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/render_mkdocs.py (reported line 521)May include surrounding context.
python
# Install only if mkdocs isn't already importable in the venv. py = venv_python(venv_path) probe = subprocess.run( [str(py), "-c", "import mkdocs, material, mermaid2"], capture_output=True, )

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script hardcodes lang: "zh-CN" and also emits Chinese UI strings such as 本页目录, 上一页, 下一页, plus the generated index page uses Chinese titles. This imposes a specific language/locale on all rendered sites regardless of user preference or source content, which matches the locale policy violation criteria.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The comment says VitePress-rewritten links will resolve cleanly under both file:// and static HTTP hosts. However, the generated VitePress config explicitly documents that opening the built site directly via file:// is unsupported because the router requires an HTTP server. This is an active contradiction in inline documentation rather than a mere omission.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/render_vitepress.mjs:465