Wavespeed

• Outcome: Review
• Latest audit: Sep 9, 2026 · 3:43 AM UTC
• Version: 0.1.0

Overview

The skill is coherent for WaveSpeed media generation, but it asks users to run an unpinned CLI and may expose API keys through chat and command-line use.

Review before installing. Prefer a pinned, locally scoped CLI install and the browser-based wavespeed login flow. Do not paste WaveSpeed API keys into chat or run commands that place live keys directly on the command line; rotate any key already exposed that way.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:125
• Finding: Unpinned Third-Party CLI Installation and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 125–129 **Vulnerability Type**: Unpinned dependency installation and execution **Risk Level**: High **Vulnerable Code**: ```bash npm install -g @wavespeed/cli # global install (may need sudo/nvm) npx @wavespeed/cli <cmd> # drop-in, no install needed ``` ```text The npm package name is **`@wavespeed/cli`**, not `wavespeed`. If global install fails due to permissions, `npx @wavespeed/cli` works identically as a drop-in replacement for all subcommands (just prefix every call with `npx @wavespeed/cli` instead of `wavespeed`). ``` ### Technical Analysis The documented installation and execution commands do not pin `@wavespeed/cli` to a reviewed version or verify package integrity. Consequently, the code executed by the agent can differ from the code that existed when this Skill was audited. The `npx @wavespeed/cli` command may download the current package release from the configured npm registry and execute it immediately. The global installation alternative increases exposure by making the package available throughout the user's environment. The accompanying reference to installations that may require elevated installation methods further increases potential impact if a user chooses to run npm with `sudo`. No evidence establishes that the current package is malicious. The vulnerability is the unsafe, mutable supply-chain execution pattern, which creates an exploitable path if the package, publisher account, registry response, or local npm configuration is compromised. ### Attack Path 1. An attacker compromises the package publisher account, a registry dependency, the configured npm registry, or another component of the package supply chain. 2. The attacker publishes or serves a modified release under the expected package name. 3. The user or agent follows the Skill and runs `npx @wavespeed/cli` or globally installs the unpinned package. 4. ...[truncated 1087 chars]
• Remediation: ## Remediation Suggestions 1. Pin the CLI to an exact, reviewed version, such as `@wavespeed/cli@X.Y.Z`, rather than resolving the latest release dynamically. 2. Maintain a lockfile with integrity metadata and install through a controlled project environment using `npm ci`. 3. Verify package provenance, publisher identity, signatures where available, and expected integrity hashes before execution. 4. Avoid global installation and never recommend `sudo npm install`. Use an isolated, least-privileged environment instead. 5. Require explicit user approval before downloading or installing executable dependencies. 6. Establish a version-update review process so a new package release is audited before the pinned version changes. 7. Where feasible, use an internally mirrored or allowlisted registry containing only reviewed package versions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:143
• Finding: API Key Exposure Through Chat and Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 143–148 **Vulnerability Type**: Plaintext secret handling and command-line credential exposure **Risk Level**: Medium **Vulnerable Code**: ```text **If the user pastes a key into chat manually** (e.g. `wsk_live_XXXXXX`), save it with `--api-key`: ``` ```bash wavespeed login --api-key "wsk_live_XXXXXX" # or via npx: npx @wavespeed/cli login --api-key "wsk_live_XXXXXX" ``` ### Technical Analysis The Skill explicitly supports users pasting an API key into chat and then places that secret directly in a command-line argument. This creates multiple plaintext exposure surfaces. A key pasted into chat may be retained in conversation history, application logs, telemetry, backups, or audit records. Passing the key through `--api-key` may additionally expose it through shell history, process inspection, command logging, terminal capture, or agent tool-call records. Quoting the key prevents ordinary shell word splitting but does not protect it from these disclosure channels. The placeholder shown in the file is not a real credential, and no hardcoded live secret was found. The vulnerability arises when the documented workflow is followed with a genuine user key. ### Attack Path 1. The user follows the Skill and pastes a valid WaveSpeed API key into the conversation. 2. The agent constructs a command containing the key in the `--api-key` argument. 3. The secret is retained in one or more locations, such as chat history, agent execution logs, shell history, process metadata, monitoring telemetry, or backups. 4. A local user, administrator, support operator, compromised logging service, or other party with access to those records obtains the key. 5. The party reuses the key to authenticate to WaveSpeed and perform operations under the victim's account until the key is revoked or expires. ### Impact Assessment An exposed key can provide the attacker with the ...[truncated 545 chars]
• Remediation: ## Remediation Suggestions 1. Remove instructions asking users to paste API keys into chat. 2. Prefer `wavespeed login` with an interactive authentication flow that does not expose the credential to the agent or command-line arguments. 3. If direct key entry is unavoidable, use a hidden terminal prompt or a secure credential helper that reads from protected standard input. 4. Store credentials in the operating system's secret store or another access-controlled credential manager rather than plaintext files or shell history. 5. Ensure agent tooling, command logging, telemetry, and error reporting redact strings matching WaveSpeed key formats. 6. Use narrowly scoped, short-lived keys where the service supports them, and apply spending limits or usage alerts. 7. Instruct users to revoke and rotate any key already pasted into chat or exposed through command history. 8. Avoid placing secrets in environment variables where they may be captured by diagnostics unless the execution environment provides explicit secret masking and isolation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The skill explicitly instructs the agent to handle a user API key pasted into chat and pass it on the command line to `wavespeed login --api-key`. That expands the skill from media generation into credential handling, which raises exposure risk because chat logs, shell history, process listings, or tool telemetry may capture the secret. In this context the behavior is not overtly malicious, but it is an unnecessary secret-handling pattern for a content-generation skill.

Static analysis

No suspicious patterns detected.