ClawHub
Back to skill

Security audit

WeKnora

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a straightforward WeKnora API guide, but it under-discloses destructive edit/delete authority and lacks guardrails around those actions.

Review this skill before installing if your WeKnora knowledge bases contain sensitive or business-critical content. Use least-privilege API keys, avoid storing keys directly in shell profiles, require HTTPS for WEKNORA_BASE_URL, and only allow edit or delete calls after explicit user confirmation of the exact knowledge entry.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:20
Finding

Plaintext API Key Persistence and Missing HTTPS Enforcement

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–51
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

The Skill recommends persisting a long-lived WeKnora API key in a plaintext shell startup file. It subsequently transmits that key to the environment-configured base URL without validating that the URL uses HTTPS.

bash
export WEKNORA_BASE_URL="https://your-server.com/api/v1"
export WEKNORA_API_KEY="sk-your-api-key"

> Add the above to ~/.zshrc or ~/.bashrc to persist across sessions.

bash
if [ -z "$WEKNORA_BASE_URL" ] || [ -z "$WEKNORA_API_KEY" ]; then
  echo "Missing WeKnora credentials. Set WEKNORA_BASE_URL and WEKNORA_API_KEY per Setup."
  exit 1
fi
bash
wk_api() {
  local method="$1" endpoint="$2" body="$3"
  curl -s -X "$method" "$WEKNORA_BASE_URL/$endpoint" \
    -H "X-API-Key: $WEKNORA_API_KEY" \
    -H "Content-Type: application/json" \
    -H "X-Request-ID: $(uuidgen 2>/dev/null || date +%s)" \
    ${body:+-d "$body"}
}

Technical Analysis

Shell startup files are generally plaintext configuration files and are not purpose-built secret stores. Persisting the API key in ~/.zshrc or ~/.bashrc increases its exposure to local users, processes, backup systems, diagnostic tooling, and accidental disclosure through configuration sharing.

Although the example base URL uses HTTPS, the request helper accepts any value supplied through WEKNORA_BASE_URL. It performs no scheme validation before placing WEKNORA_API_KEY in the X-API-Key header. If the variable is configured with an http:// URL, the credential and request contents can traverse the network without transport encryption.

Attack Path

Local credential-disclosure path:

  1. A user follows the documented persistence recommendation and stores WEKNORA_API_KEY in a shell startup file.
  2. Another local account, process, backup service, s ...[truncated 1359 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not recommend storing API keys directly in ~/.bashrc, ~/.zshrc, or other plaintext startup files.
  2. Retrieve the credential from a platform secret manager, operating-system keychain, or dedicated credential helper at runtime.
  3. If file-based storage is unavoidable, use a dedicated file with permissions restricted to the owner, such as mode 0600, and load it only for the process that requires the credential.
  4. Validate WEKNORA_BASE_URL before every request and reject any URL that does not use https://.
  5. If local plaintext HTTP is required for development, allow it only through an explicit opt-in restricted to loopback addresses such as 127.0.0.1 or localhost.
  6. Consider restricting allowed API hosts to a configured allowlist to reduce credential forwarding to unintended destinations.
  7. Apply least privilege and expiration controls to API keys, and rotate any key that may previously have been stored or transmitted insecurely.
  8. Ensure shell profiles, backups, logs, and support archives do not contain previously persisted credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The skill exposes a raw DELETE operation on knowledge entries with no documented validation, scoping guardrails, or confirmation requirements. In an agent environment, prompt-induced parameter abuse or mistaken ID selection could cause unauthorized or unintended destructive actions against external data.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
|Check upload progress |`GET /knowledge/:id` |watch `parse_status` |
|Browse KB contents |`GET /knowledge-bases/:id/knowledge` |`page`, `page_size`, `tag_id` |
|Edit Markdown knowledge |`PUT /knowledge/manual/:id` |`title`, `content` |
|Delete a knowledge entry |`DELETE /knowledge/:id` |— |
|Search within a KB |`GET /knowledge-bases/:id/hybrid-search` |`query_text`, `match_count`, thresholds |
|Search across KBs |`POST /knowledge-search` |`query`, `knowledge_base_ids` |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs users to upload files, URLs, and Markdown to an external WeKnora service without an explicit disclosure that potentially sensitive user data will leave the local environment. In an agent setting, this can lead to unintentional exfiltration of confidential content to a third-party API.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest advertises import, retrieval, and listing, but the body also documents edit and delete capabilities. This expands the effective behavior beyond what callers may expect, increasing the risk of unintended destructive actions and undermining least-privilege and informed-consent assumptions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Documenting a delete endpoint without any warning about its destructive effect increases the chance that an agent or user will invoke irreversible deletion unintentionally. In a knowledge-base management context, deletion can remove stored documents and disrupt downstream retrieval workflows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

L030 states that credential verification should occur before any API call and that execution should stop if variables are unset. But the wk_api helper in L044-L051 and subsequent example workflows call curl directly without embedding or enforcing that guard, so the documented safety behavior is not what the shown operational code actually does.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.