wjx-cli-use

• Outcome: Review
• Latest audit: Aug 21, 2026 · 6:57 AM UTC
• Version: 0.3.5

Overview

The skill is a real Wenjuanxing CLI helper, but it needs Review because it asks agents to handle API keys and includes high-impact account, SSO, and deletion operations with limited safeguards.

Install only if you intend to let an agent operate your Wenjuanxing account through wjx-cli. Configure API keys locally or through a secure secret mechanism rather than pasting them into chat, review every destructive or account-management action before it runs, and avoid using the bundled sudo/global install path unless you accept the package-install risk.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill repeatedly instructs the agent to execute shell commands such as npm install, wjx init, doctor, survey creation, and response operations, yet no explicit permissions are declared. That mismatch can cause users or the host system to underestimate the skill's execution capability and risk, especially because the commands can install software, persist credentials, and interact with external APIs.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is described as guidance for survey creation, response querying, and analysis, but this file documents significantly broader enterprise-management capabilities: contacts, departments, admins, sub-accounts, and SSO. That scope expansion increases the chance an agent will assist with privileged identity and access operations unrelated to the user’s survey task, enabling destructive changes or privilege-management actions under an overly broad skill trigger.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documentation includes commands for generating passwordless or authenticated SSO login URLs that are not clearly necessary for the stated survey-guidance purpose. In an agent setting, exposing magic-link generation without strict contextual limits can facilitate account access, impersonation, or session bootstrapping if the agent is socially engineered into producing these links for an unauthorized target.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation exposes an irreversible `wjx response clear` capability that deletes survey responses, which is materially more destructive than the skill’s stated purpose of guiding survey creation, querying, and analysis. Even as documentation, surfacing this command inside the skill enables misuse by an agent or user and lacks justification, guardrails, confirmation requirements, or authorization guidance.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file documents `response submit`, `submit-template`, and `modify`, which allow creating or altering survey records despite the manifest emphasizing creation, querying responses, and analysis rather than record tampering or grading changes. This scope expansion increases the chance an agent performs state-changing actions the user did not expect, especially because the guidance is operational and encourages direct execution.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: `wjx response clear` is an unjustified irreversible deletion capability for a skill positioned as survey guidance and analysis. In this context, deletion of all response data can cause permanent business, compliance, and audit loss, making the mismatch between advertised purpose and actual capability especially dangerous.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The description uses very broad triggers including common words like 调查, 表单, 投票, survey, questionnaire, and even general management/analysis intents, which increases the chance of accidental activation in unrelated conversations. Because the skill can execute shell commands and manage credentials, overbroad routing makes unintended invocation materially more dangerous than a harmless documentation-only skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to handle API keys, including overriding credentials on the command line and storing them via initialization, but does not give a clear user-facing warning about credential sensitivity, retention, or persistence. This creates a substantial risk of credential disclosure in chat logs, shell history, agent traces, or local config files, enabling unauthorized access to the user's survey/account data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: These SSO commands generate passwordless or pre-authenticated access URLs, but the documentation does not warn that the resulting links are effectively bearer credentials. Without that warning, an agent or user may log, share, or paste the URLs into insecure channels, enabling unauthorized access by anyone who obtains the link.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The account deletion command is documented without any explicit warning about business impact, access loss, audit implications, or whether recovery is guaranteed. In an agent-assisted environment, omission of safety guidance increases the risk of accidental or unauthorized destructive actions being carried out on administrative identities.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to execute a remote script via curl piped directly to bash, which bypasses inspection of the downloaded content before execution. If the upstream URL, transport, or distribution channel is compromised, users could execute arbitrary attacker-controlled code on their machine. In a general-purpose CLI installation guide, this is an unsafe pattern and the lack of any caution increases the risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The Linux instructions use a remote bootstrap script piped into sudo-enabled shell execution, which is more dangerous because it can run arbitrary code with elevated privileges. A compromise of the remote host, the script supply chain, or the repository setup path could lead to full system-level compromise. In an installation guide, this remains risky even if common, and the absence of warnings or verification steps makes it a true security issue.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The bulk download section enables export of potentially sensitive survey responses at scale but does not warn about privacy, access control, data minimization, or handling of personally identifiable or confidential information. In a survey context, response exports commonly contain employee, customer, health, or exam-related data, so omission of safeguards raises meaningful confidentiality risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The answer submission and import instructions describe how to create or alter survey records without warning that these actions modify production data or may constitute impersonation, fraud, or contamination of analytics. Because the skill provides exact command sequences and formatting tips, it lowers the barrier to performing unauthorized or accidental record manipulation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script automatically performs a global npm installation and, on failure, escalates to `sudo npm install -g wjx-cli` without an explicit confirmation prompt at the point of privilege use. Installing packages globally from a registry executes package lifecycle scripts and can modify system-wide paths, so silent escalation increases the blast radius if the package or dependency chain is compromised.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly tells the user to obtain an API key and send it back to the agent. Requesting secrets through normal chat is dangerous because the key may be retained in conversation history, monitoring systems, model traces, or transcripts, and the agent then gains direct authority to act on the user's Wenjuanxing account.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The installation flow again instructs the user to copy their API key and provide it to the agent, then run initialization with that secret. This is a direct secret-handling anti-pattern that can expose long-lived credentials and is more dangerous here because the same skill also performs account actions, data export, response submission, and management operations using that key.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cat "$NPM_ERR" 2>/dev/null
        rm -f "$NPM_ERR"
        print_info "尝试 sudo..."
        if command -v sudo &> /dev/null; then
            if sudo npm install -g wjx-cli; then
                print_success "wjx-cli 安装成功（sudo）"
                return 0

• Confidence: 97% confidence
• Finding: sudo

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

rm -f "$NPM_ERR"
        print_info "尝试 sudo..."
        if command -v sudo &> /dev/null; then
            if sudo npm install -g wjx-cli; then
                print_success "wjx-cli 安装成功（sudo）"
                return 0
            fi

• Confidence: 97% confidence
• Finding: sudo

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.