wemol-cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:01 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Wemol CLI operating guide, but its install instructions ask agents or users to run mutable remote installers and bypass platform security warnings.

Review the installer and credential handling before installing. Prefer a signed package or a download-verify-run process, avoid command-line passwords, and do not bypass Gatekeeper or SmartScreen unless you independently trust and verify the exact Wemol binary.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/install.md:37
• Finding: Mutable Unix Installer Is Retrieved and Executed Without Prior Verification<![CDATA[ ## Vulnerability Details **File Location**: `references/install.md`, lines 37–60 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: Critical ### Vulnerable Code ```bash ## macOS and Linux Install with the Unix installer: curl -LsSf https://wemol.wecomput.com/static/wemol-cli/latest/install.sh | sh The default release base URL is: https://wemol.wecomput.com/static/wemol-cli To override it temporarily: curl -LsSf https://wemol.wecomput.com/static/wemol-cli/latest/install.sh | \ WEMOL_INSTALL_BASE_URL="https://your-release-base" sh To install a specific version: curl -LsSf https://wemol.wecomput.com/static/wemol-cli/latest/install.sh | \ sh -s -- --version v1.0.0 ``` ### Technical Analysis The instructions pipe content retrieved from a mutable `latest/install.sh` URL directly into a shell. The script is not saved for inspection, pinned by digest, or cryptographically authenticated before execution. Although the documentation states that the installer later retrieves `SHA256SUMS` for binary artifacts, that does not authenticate the installer itself. The remote script is already executing before it performs any artifact verification. A checksum retrieved from the same distribution origin also does not protect against compromise of that origin. The nominally version-specific command pins only the binary version argument. It still executes the mutable `latest/install.sh` script. The release-base override also allows the executing installer to retrieve artifacts from an arbitrary location. This may be legitimate for testing, but it increases supply-chain risk if an attacker can influence the environment or generated command. ### Attack Path 1. `wemol-cli` is absent or below the documented baseline. 2. The Skill directs the agent or user to invoke the installation command. 3. The distribution endpoint, DNS/TLS path, hosting account, or mutable installer content is compromised. 4. The attacker re ...[truncated 746 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every `curl | sh` installation command. 2. Resolve and display an immutable release version before downloading. 3. Download the installer or binary to a local file without executing it. 4. Verify a cryptographic signature using a trusted public key distributed separately from the release server. 5. Pin the expected artifact digest in the reviewed Skill release; do not rely solely on a checksum fetched from the same mutable origin. 6. Inspect the downloaded script or use a minimal, locally reviewed installation routine. 7. Require explicit user approval before executing a downloaded installer. 8. Restrict destination permissions and ensure the installer cannot modify unrelated shell or startup configuration. 9. Remove or tightly constrain `WEMOL_INSTALL_BASE_URL`; never allow untrusted input to select an executable distribution source. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/install.md:92
• Finding: PowerShell Evaluates Mutable Remote Code With Execution Policy Bypassed<![CDATA[ ## Vulnerability Details **File Location**: `references/install.md`, lines 92–108 **Vulnerability Type**: Remote PowerShell payload retrieval and evaluation **Risk Level**: Critical ### Vulnerable Code ```powershell Install with the PowerShell installer: powershell -ExecutionPolicy ByPass -c "irm https://wemol.wecomput.com/static/wemol-cli/latest/install.ps1 | iex" To override the release base URL: $env:WEMOL_INSTALL_BASE_URL = "https://your-release-base" powershell -ExecutionPolicy ByPass -c "irm https://wemol.wecomput.com/static/wemol-cli/latest/install.ps1 | iex" To install a specific version: powershell -ExecutionPolicy ByPass -c "& ([scriptblock]::Create((irm https://wemol.wecomput.com/static/wemol-cli/latest/install.ps1))) -Version v1.0.0" ``` ### Technical Analysis `Invoke-RestMethod` (`irm`) retrieves mutable network content, while `Invoke-Expression` (`iex`) or `ScriptBlock.Create` converts that content directly into executable PowerShell. The command also launches PowerShell with `ExecutionPolicy ByPass`, suppressing a platform control that could otherwise warn about or restrict script execution. Supplying `-Version v1.0.0` does not authenticate the installer because the installer itself still comes from the mutable `latest/install.ps1` URL. The release-base environment override further permits the installer to select an arbitrary artifact source. ### Attack Path 1. Installation or upgrade is triggered because the CLI is unavailable or outdated. 2. PowerShell starts with execution-policy checks bypassed. 3. The command retrieves content from the mutable installer endpoint. 4. An attacker controlling the endpoint or delivery path supplies malicious PowerShell. 5. `iex` or `ScriptBlock.Create` evaluates the response without prior inspection or signature verification. 6. The payload accesses user resources and may place a malicious `wemol-cli.exe` at the expected installation path. ### Impact Assessment The payload obtains the fu ...[truncated 441 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `Invoke-Expression`, `ScriptBlock.Create`, and `-ExecutionPolicy ByPass` from installation guidance. 2. Download an immutable, versioned artifact to disk first. 3. Require a valid Authenticode signature from an expected publisher. 4. Verify an independently pinned digest after signature verification. 5. Abort installation if the signature, publisher identity, version, or digest is unexpected. 6. Require explicit user confirmation after displaying the verified artifact details. 7. Use a package manager or signed installer with established provenance where possible. 8. Do not permit an untrusted environment variable to redirect executable downloads. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/install.md:77
• Finding: Instructions Encourage Gatekeeper Override for an Unsigned macOS Binary<![CDATA[ ## Vulnerability Details **File Location**: `references/install.md`, lines 77–88 **Vulnerability Type**: Bypass of operating-system application provenance controls **Risk Level**: High ### Vulnerable Code ```text ## macOS Security Notice Current macOS builds are not yet distributed with a valid developer signature/notarization chain. On a new Mac, the first launch may be blocked by Gatekeeper. If that happens, ask the user to manually allow the binary: 1. Try running `wemol-cli --help` once. 2. Open `System Settings -> Privacy & Security`. 3. Find the blocked `wemol-cli` item and choose `Allow Anyway`. 4. Run the command again and confirm the security prompt. This is currently expected for macOS release builds until official signing is added. ``` ### Technical Analysis The distributed macOS binary lacks a valid developer signature and notarization chain. The Skill responds to Gatekeeper blocking the binary by instructing the user to select `Allow Anyway`. This bypasses a platform provenance control without providing an equivalent independent authenticity mechanism. Reviewing the apparent download domain does not prove that the downloaded binary is the intended artifact, especially when the installation process itself executes mutable remote code. ### Attack Path 1. A legitimate release is replaced or a user receives a substituted unsigned binary. 2. macOS Gatekeeper blocks or warns about its first execution. 3. Following the Skill, the user manually chooses `Allow Anyway`. 4. The substituted binary executes despite lacking a trusted signature or notarization record. 5. The binary operates with the current user’s permissions. ### Impact Assessment A malicious binary could access user-readable research data, account material, cached sessions, and local files, and could modify user configuration or establish user-level persistence. Gatekeeper would have interrupted this path, but the instructions normalize overriding that protection. The i ...[truncated 169 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Sign macOS binaries using a valid Apple Developer ID certificate. 2. Submit releases for Apple notarization and staple the notarization result where applicable. 3. Remove instructions telling users to choose `Allow Anyway`. 4. Stop installation when provenance verification fails. 5. Until signing is available, require an independently authenticated signature and pinned digest, while clearly documenting that this is a temporary and weaker distribution model. 6. Publish reproducible-build information so users can independently validate release artifacts. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/install.md:123
• Finding: Instructions Encourage SmartScreen Override for an Unsigned Windows Binary<![CDATA[ ## Vulnerability Details **File Location**: `references/install.md`, lines 123–133 **Vulnerability Type**: Bypass of operating-system reputation and signing controls **Risk Level**: High ### Vulnerable Code ```text ## Windows Security Notice Current Windows builds are not yet distributed with a code-signing certificate. Because of that, Windows Defender SmartScreen or browser download protection may warn about `wemol-cli.exe` on first download or launch. If that happens, ask the user to review the file source and then use the standard Windows override flow, such as: 1. Keep the downloaded file if the browser marks it as uncommon. 2. Run `wemol-cli.exe --help` once. 3. If SmartScreen blocks it, choose `More info` and then `Run anyway`. This is currently expected for Windows release builds until official code signing is added. ``` ### Technical Analysis The Windows executable is explicitly described as unsigned. The Skill instructs users to retain a browser-flagged file and choose `Run anyway` when SmartScreen blocks it. This suppresses application reputation and publisher-verification controls without replacing them with an independent signature-verification process. Checking the visible source URL is not sufficient to verify artifact integrity or publisher identity. ### Attack Path 1. An attacker substitutes the unsigned Windows artifact or compromises its distribution path. 2. Browser protection or SmartScreen warns about or blocks the executable. 3. The user follows the Skill’s instructions to retain the file and select `Run anyway`. 4. Windows executes the untrusted binary. 5. The executable gains the privileges of the launching process. ### Impact Assessment The executable could read or modify user files, access cached authentication material, replace command-line tools, alter user PATH or profile state, and establish persistence. If the user launches it from an elevated context, the impact expands to administrative resources. The g ...[truncated 114 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Sign all Windows binaries and installers with a trusted code-signing certificate. 2. Remove instructions to choose `Run anyway` or retain files flagged by browser protection. 3. Verify the Authenticode publisher and signature before execution. 4. Publish immutable releases with independently verifiable signatures and pinned hashes. 5. Abort execution when SmartScreen or signature validation indicates an unexpected artifact. 6. Prefer a signed package distributed through a reputable package manager or signed installer channel. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:42
• Finding: Plaintext Passwords Are Passed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md`, lines 42–49 - `references/session-and-host.md`, lines 49–61 **Vulnerability Type**: Plaintext credential exposure through process arguments and command history **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```bash If authentication error appears, stop and run: wemol-cli login If interactive login is not possible (non-TTY), use: wemol-cli login --username <name> --password <password> ``` From `references/session-and-host.md`: ```bash ## Login Interactive: wemol-cli login Non-interactive: wemol-cli login --username alice --password secret Do not mix the two modes. `--username` and `--password` must be provided together. ``` ### Technical Analysis Passing a password as a command-line argument can expose it through shell history, process listings, terminal capture, agent execution transcripts, audit telemetry, crash diagnostics, and automation logs. The example uses a literal password and normalizes this authentication pattern. Although `secret` appears illustrative rather than a real hardcoded credential, users or agents are expected to replace it with an actual password, creating an avoidable disclosure path. ### Attack Path 1. An agent or user constructs the documented non-interactive login command with a real password. 2. The command is recorded in shell history, an agent transcript, process metadata, or operational logs. 3. A local user, monitoring service, log reader, or compromised process obtains the command text. 4. The exposed credentials are used to access the Wemol account. 5. The attacker may inspect jobs, account information, uploaded datasets, and downloadable outputs according to the account’s authorization. ### Impact Assessment Exposure could compromise the Wemol account and any remote resources available to it. This may include proprietary biology or chemistry inputs, job history, generated results, token usage information, and storage metadata ...[truncated 178 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove password-bearing command-line examples. 2. Read passwords from a protected interactive prompt or standard input without echo. 3. For non-interactive environments, use short-lived device authorization, scoped tokens, or an operating-system credential store. 4. If environment-based authentication is unavoidable, use a narrowly scoped process environment and ensure the CLI, agent, and logs redact the value. 5. Prevent commands containing secrets from being written to shell history or execution transcripts. 6. Ensure authentication errors and verbose output never reproduce secret values. 7. Prefer revocable, least-privilege tokens over reusable account passwords. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Ae1

High

• Category: analysis-evasion

Content

This `SKILL.md` is now self-sufficient for normal operation. `references/` and `examples/` are secondary for edge cases and domain-specific patterns.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

External Script Fetching

High

• Category: Supply Chain

Content

Install with the Unix installer:

```bash
curl -LsSf https://wemol.wecomput.com/static/wemol-cli/latest/install.sh | sh
```

The default release base URL is:

• Confidence: 99% confidence
• Finding: The command explicitly fetches an external script from the internet and executes it, creating a direct supply-chain and remote code execution risk. In the context of an agent skill, this is more dangerous because the instruction is operationalized as a recommended action rather than merely descriptive text.

Chaining Abuse

High

• Category: Tool Misuse

Content

Install with the Unix installer:

```bash
curl -LsSf https://wemol.wecomput.com/static/wemol-cli/latest/install.sh | sh
```

The default release base URL is:

• Confidence: 98% confidence
• Finding: The `| sh` pipeline chains network retrieval directly into shell execution, preventing review and making any compromise of the remote content immediately exploitable. This pattern is broadly discouraged because it compresses trust, transport, and execution into a single step with minimal user visibility.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The PowerShell installer instructions combine remote script fetching, immediate evaluation with `iex`, and execution-policy bypass, yet do not foreground the system-impacting risk. This exposes users to silent arbitrary code execution and persistence opportunities if the endpoint or installer is compromised.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The Windows installation command fetches remote PowerShell and executes it with `iex` while also using `ExecutionPolicy ByPass`, collapsing multiple safety barriers at once. This creates a high-risk arbitrary code execution path and is especially severe in agent-consumable instructions because it encourages non-interactive execution of untrusted network content.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly recommends `wemol-cli login --username <name> --password <password>` for non-TTY environments, which encourages passing secrets on the command line. Command-line passwords are commonly exposed via shell history, process listings, audit logs, CI job logs, and telemetry, making credential disclosure likely in real operational use.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown presents direct execution of downloaded installer code without an explicit warning about the risks of running network-fetched scripts. This is unsafe because users or agents may execute privileged or persistent changes without validating source integrity, content, or authenticity.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The document instructs direct execution of a remotely fetched shell script via a pipeline, which gives the remote server immediate code execution on the host with no review step. In a skill/manual context, this is dangerous because it normalizes unsafe install behavior and could be abused if the distribution endpoint, transport, or release pipeline is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The macOS security notice tells users to override Gatekeeper for an unsigned binary, weakening a platform trust control intended to block unverified executables. Even if operationally motivated, this increases the chance users will run tampered or malicious binaries and trains them to ignore security prompts.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The Windows security notice advises bypassing SmartScreen for an unsigned executable, which reduces an important safeguard against malicious or low-reputation binaries. In agent-facing docs, this is risky because it can habituate users to override security warnings without strong provenance validation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- If upstream check is blocked (network/channel unavailable), explicitly report what was checked and what is blocked.

Required response style:
- Do not ask the user to perform the comparison themselves as the primary answer.
- Return one of: `update required`, `no update required from current evidence`, or `cannot verify upstream latest due to <specific blocker>`.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The file instructs users to set the CLI language explicitly to `en` or `cn` and states that module descriptions follow this language, but it does not present language selection as an explicit user choice or document why the restriction is necessary. This creates a natural-language locale policy concern because the skill appears to prescribe a specific language setting rather than offering an opt-in preference.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation includes a non-interactive login example that places a plaintext password directly on the command line. Command-line secrets can be exposed through shell history, process listings, audit logs, or terminal recording, making credential compromise more likely. In a CLI operating manual, this is especially risky because users may copy-paste the example verbatim.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The markdown instructs `job download` operations, including writing into `./result_dir` and `./downloads`, but does not disclose that these commands create or modify local files. For markdown skills, operations affecting user data or system state should include a clear warning so users understand the filesystem impact.

Static analysis

No suspicious patterns detected.