T08 · Insecure Dependencies
Warning
- Location
SKILL.md:25- Finding
Unpinned Global Installation of a Third-Party CLI Package
- Content
View full analysis
- Remediation
View remediation
Security audit
Weeko
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned bookmark management, but it needs Review because it gives agents broad delete authority while relying on a mutable global CLI install and locally stored API credentials.
Install only if you trust the `weeko-cli` npm package and the Weeko service. Pin or review the CLI version where possible, keep the API key out of chat logs, avoid custom API URLs unless you control them, and require explicit confirmation plus a reviewed target list before group or batch deletion.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/commands.md:172- Finding
Bearer Credential Can Be Redirected to a Configurable API Endpoint
- Content
View full analysis
` header. ``` ### Technical Analysis Using a Bearer API key with the legitimate Weeko service is necessary for the declared bookmark-management functionality. The risk arises because the destination can be replaced through `WEEKO_API_URL`, while the API key can be supplied through `WEEKO_API_KEY` or stored in a plaintext JSON configuration file. If an attacker can influence the environment or configuration used to launch the CLI, the documented behavior may cause the client to send the Weeko Bearer credential to an attacker-controlled endpoint. Bearer tokens are usable by any party that possesses them, without proof of possession or device binding. Plaintext storage in `~/.config/weeko-cli/config.json` also exposes the key to other processes or users if file and directory permissions are not restrictive. The CLI implementation is absent from the audited artifact, so the following controls cannot be verified: - Validation or allowlisting of custom endpoint hosts - Enforcement of HTTPS - Rejection of embedded credentials or deceptive hostnames - Credential handling across HTTP redirects - Owner-only permissions on the configuration directory and file - Redaction of credentials from logs, errors, and d ...[truncated 1825 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly advertises delete and batch-delete capabilities but does not warn about irreversible data loss or recommend confirmation and dry-run usage before destructive actions. In an agent skill context, this is more dangerous because an autonomous or semi-autonomous assistant may execute deletion commands based on ambiguous user intent, increasing the chance of accidental bulk data removal.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The README instructs users or agents to authenticate with an API key but provides no guidance on secure credential handling, storage, redaction, or avoiding exposure in logs and chat transcripts. In an AI agent environment, this raises the risk that the key could be echoed, persisted, or mishandled by tooling, enabling unauthorized access to the user's bookmark account.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documents a bulk deletion command without any nearby warning, confirmation behavior, or safer usage guidance, which can normalize destructive use by an agent or user and increase the chance of accidental mass data loss. In this skill’s context, bookmark and group management are state-changing operations, so presenting batch delete as a simple routine command without emphasizing safeguards makes misuse more dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file describes bookmark, group, and batch delete commands, but it does not include any warning that these operations remove user data or may be irreversible. Under the markdown-specific warning criterion, destructive behaviour that could affect user data should be disclosed to users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
L03 明确将当前文档标记为“中文文档”，属于自然语言层面的语言限定。虽然同时提供了英文文档链接，但该文件本身未说明代理是否可根据用户偏好切换语言，因此存在默认强制特定语言的政策风险。
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file states that the API key is stored in a local config file and can also be provided by environment variable, but it does not warn users that credentials will be persisted on disk or discuss the sensitivity of that file. For markdown skill documentation, storing credentials affects privacy and system security and should be clearly disclosed.
- Content
Static analysis
No suspicious patterns detected.