T09 · Insecure Skill Coding Practices
Warning
- Location
bin/wiki.js:43- Finding
Bearer Token and Wiki Content May Be Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
Wiki Js V3
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real Wiki.js administration tool, but it can delete or change wiki content immediately and has under-scoped transport and dependency risks.
Install only if you are comfortable giving this skill a Wiki.js API token that can modify your wiki. Use a least-privilege API key, configure an HTTPS WIKIJS_URL for any non-local server, avoid using broad production admin tokens, and treat delete, restore, move, tag delete, and asset-delete commands as high-risk because the CLI does not ask for confirmation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:10- Finding
Unpinned and Unused npm Dependencies Expand the Supply-Chain Attack Surface
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md bin/wiki.js
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises network access and use of sensitive environment variables like WIKIJS_TOKEN but does not declare any explicit tool scope or permission boundaries. In an agent setting, this weakens reviewability and can allow broader-than-expected outbound requests or secret use, increasing the chance of unintended data access or exfiltration.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The environment configuration states that the default locale is
de, which imposes a specific language/locale choice unless the user overrides it. The policy requires language or locale selection to be user-chosen or clearly justified, and no opt-in or justification is provided here.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill documents destructive operations such as page deletion, move, copy, and version restore without clearly warning that these actions can permanently alter or remove content. In an agent-driven workflow, missing friction or safety language increases the risk of accidental destructive execution against a production wiki.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Asset deletion is presented as a normal operation without a clear warning that files may be permanently removed and references may break across pages. In a documentation administration skill, an agent could delete shared media unintentionally, causing content loss and site breakage.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code sets
DEFAULT_LOCALEtodewhen no locale is provided, which forces a specific language/locale choice by default. The file does not justify this as a region-specific tool, so this is a natural-language locale policy issue under the stated rules.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI directly performs page deletion when the
deletecommand is invoked, but there is no confirmation prompt or explicit warning at the point of execution. Although the help text names the command, it does not warn about the irreversible impact of deleting wiki content, so users may trigger a destructive action without adequate disclosure.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The
asset-deletecommand invokes asset removal immediately with no user confirmation and no user-facing warning about deleting stored files. This is a destructive operation affecting user data and lacks the disclosure expected for safety-critical actions.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation states 'Node.js built-in modules only' and says form-data is merely installed on-demand, but the manifest explicitly declares external npm dependencies including graphql-request, form-data, and node-fetch. This is an active contradiction in the skill's documentation about how the code/package actually operates.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- bin/wiki.js:46