Security audit

wemol-cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Wemol CLI operating guide, but its install instructions ask agents or users to run mutable remote installers and bypass platform security warnings.

Review the installer and credential handling before installing. Prefer a signed package or a download-verify-run process, avoid command-line passwords, and do not bypass Gatekeeper or SmartScreen unless you independently trust and verify the exact Wemol binary.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/install.md:37
Finding: Mutable Unix Installer Is Retrieved and Executed Without Prior Verification
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: references/install.md:92
Finding: PowerShell Evaluates Mutable Remote Code With Execution Policy Bypassed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/install.md:77
Finding: Instructions Encourage Gatekeeper Override for an Unsigned macOS Binary
Content: View full analysis
Privacy & Security`. 3. Find the blocked `wemol-cli` item and choose `Allow Anyway`. 4. Run the command again and confirm the security prompt. This is currently expected for macOS release builds until official signing is added. ``` ### Technical Analysis The distributed macOS binary lacks a valid developer signature and notarization chain. The Skill responds to Gatekeeper blocking the binary by instructing the user to select `Allow Anyway`. This bypasses a platform provenance control without providing an equivalent independent authenticity mechanism. Reviewing the apparent download domain does not prove that the downloaded binary is the intended artifact, especially when the installation process itself executes mutable remote code. ### Attack Path 1. A legitimate release is replaced or a user receives a substituted unsigned binary. 2. macOS Gatekeeper blocks or warns about its first execution. 3. Following the Skill, the user manually chooses `Allow Anyway`. 4. The substituted binary executes despite lacking a trusted signature or notarization record. 5. The binary operates with the current user’s permissions. ### Impact Assessment A malicious binary could access user-readable research data, account material, cached sessions, and local files, and could modify user configuration or establish user-level persistence. Gatekeeper would have interrupted this path, but the instructions normalize overriding that protection. The i ...[truncated 169 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/install.md:123
Finding: Instructions Encourage SmartScreen Override for an Unsigned Windows Binary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:42
Finding: Plaintext Passwords Are Passed Through Command-Line Arguments
Content: View full analysis
--password ``` From `references/session-and-host.md`: ```bash ## Login Interactive: wemol-cli login Non-interactive: wemol-cli login --username alice --password secret Do not mix the two modes. `--username` and `--password` must be provided together. ``` ### Technical Analysis Passing a password as a command-line argument can expose it through shell history, process listings, terminal capture, agent execution transcripts, audit telemetry, crash diagnostics, and automation logs. The example uses a literal password and normalizes this authentication pattern. Although `secret` appears illustrative rather than a real hardcoded credential, users or agents are expected to replace it with an actual password, creating an avoidable disclosure path. ### Attack Path 1. An agent or user constructs the documented non-interactive login command with a real password. 2. The command is recorded in shell history, an agent transcript, process metadata, or operational logs. 3. A local user, monitoring service, log reader, or compromised process obtains the command text. 4. The exposed credentials are used to access the Wemol account. 5. The attacker may inspect jobs, account information, uploaded datasets, and downloadable outputs according to the account’s authorization. ### Impact Assessment Exposure could compromise the Wemol account and any remote resources available to it. This may include proprietary biology or chemistry inputs, job history, generated results, token usage information, and storage metadata ...[truncated 178 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
This `SKILL.md` is now self-sufficient for normal operation. `references/` and `examples/` are secondary for edge cases and domain-specific patterns.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The command explicitly fetches an external script from the internet and executes it, creating a direct supply-chain and remote code execution risk. In the context of an agent skill, this is more dangerous because the instruction is operationalized as a recommended action rather than merely descriptive text.
Content: Scanner excerpt · references/install.md (reported line 40)May include surrounding context.
Install with the Unix installer:

bash
curl -LsSf https://wemol.wecomput.com/static/wemol-cli/latest/install.sh | sh

The default release base URL is:

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The | sh pipeline chains network retrieval directly into shell execution, preventing review and making any compromise of the remote content immediately exploitable. This pattern is broadly discouraged because it compresses trust, transport, and execution into a single step with minimal user visibility.
Content: Scanner excerpt · references/install.md (reported line 40)May include surrounding context.
Install with the Unix installer:

bash
curl -LsSf https://wemol.wecomput.com/static/wemol-cli/latest/install.sh | sh

The default release base URL is:

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The PowerShell installer instructions combine remote script fetching, immediate evaluation with iex, and execution-policy bypass, yet do not foreground the system-impacting risk. This exposes users to silent arbitrary code execution and persistence opportunities if the endpoint or installer is compromised.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The Windows installation command fetches remote PowerShell and executes it with iex while also using ExecutionPolicy ByPass, collapsing multiple safety barriers at once. This creates a high-risk arbitrary code execution path and is especially severe in agent-consumable instructions because it encourages non-interactive execution of untrusted network content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly recommends wemol-cli login --username <name> --password <password> for non-TTY environments, which encourages passing secrets on the command line. Command-line passwords are commonly exposed via shell history, process listings, audit logs, CI job logs, and telemetry, making credential disclosure likely in real operational use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The markdown presents direct execution of downloaded installer code without an explicit warning about the risks of running network-fetched scripts. This is unsafe because users or agents may execute privileged or persistent changes without validating source integrity, content, or authenticity.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document instructs direct execution of a remotely fetched shell script via a pipeline, which gives the remote server immediate code execution on the host with no review step. In a skill/manual context, this is dangerous because it normalizes unsafe install behavior and could be abused if the distribution endpoint, transport, or release pipeline is compromised.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The macOS security notice tells users to override Gatekeeper for an unsigned binary, weakening a platform trust control intended to block unverified executables. Even if operationally motivated, this increases the chance users will run tampered or malicious binaries and trains them to ignore security prompts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Windows security notice advises bypassing SmartScreen for an unsigned executable, which reduces an important safeguard against malicious or low-reputation binaries. In agent-facing docs, this is risky because it can habituate users to override security warnings without strong provenance validation.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/install.md (reported line 167)May include surrounding context.
md
- If upstream check is blocked (network/channel unavailable), explicitly report what was checked and what is blocked. Required response style: - Do not ask the user to perform the comparison themselves as the primary answer. - Return one of: `update required`, `no update required from current evidence`, or `cannot verify upstream latest due to <specific blocker>`.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file instructs users to set the CLI language explicitly to en or cn and states that module descriptions follow this language, but it does not present language selection as an explicit user choice or document why the restriction is necessary. This creates a natural-language locale policy concern because the skill appears to prescribe a specific language setting rather than offering an opt-in preference.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation includes a non-interactive login example that places a plaintext password directly on the command line. Command-line secrets can be exposed through shell history, process listings, audit logs, or terminal recording, making credential compromise more likely. In a CLI operating manual, this is especially risky because users may copy-paste the example verbatim.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The markdown instructs job download operations, including writing into ./result_dir and ./downloads, but does not disclose that these commands create or modify local files. For markdown skills, operations affecting user data or system state should include a clear warning so users understand the filesystem impact.
Content: No source excerpt is available for this finding.