Wiki Js V3

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:30 PM UTC
• Version:
  1.0.1

Overview

This is a Wiki.js administration CLI that openly uses a Wiki.js API token to manage wiki pages and assets, including destructive actions.

Install only if you want an agent or CLI to administer your Wiki.js instance. Use a dedicated least-privilege API token, verify WIKIJS_URL before running commands, and manually review delete, asset-delete, tags delete, upload, move, restore, and upsert operations before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The CLI performs destructive delete operations immediately once invoked, with no confirmation prompt, dry-run mode, or `--force` acknowledgement. In an agent or automation context, argument confusion, prompt injection, or mistaken tool use could lead to irreversible deletion of wiki pages or assets with valid credentials.

VirusTotal

45/45 vendors flagged this skill as clean.