CodeWiki Generator

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:29 PM UTC
• Version: 1.0.0

Overview

This skill is a repository documentation generator whose file reads, metadata generation, and documentation-site setup match its stated purpose, though users should be cautious with dependency installation and private-code metadata.

Install and run this only in a repository you are comfortable having summarized into codewiki/.meta and Markdown files. Prefer a clean branch, review generated files before committing, pin npm and wrangler versions or add a lockfile before installation, and avoid running the optional Cloudflare deployment unless you intend to use your Cloudflare account for publishing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: assets/vitepress/package.json:9

Finding

Unpinned npm Dependencies Permit Unreviewed Supply-Chain Code Execution

Content

View full analysis

Remediation

View remediation

", "vitepress": "", "vitepress-plugin-mermaid": "", "wrangler": "" } } ``` 2. Generate, review, and commit `package-lock.json` so direct and transitive dependency versions and integrity hashes are reproducible. 3. Replace: ```bash npm --prefix codewiki install ``` with: ```bash npm --prefix codewiki ci ``` 4. Avoid unversioned ephemeral execution. Pin every `npx` package explicitly, or preferably execute binaries from the lockfile-controlled local installation: ```bash npm --prefix codewiki exec -- vitepress dev . ``` 5. Replace the global Wrangler installation with a project-local, pinned development dependency. Execute it through the local package context rather than modifying the user-wide environment. 6. Where compatible with the selected packages, consider disabling lifecycle scripts during installation: ```bash npm --prefix codewiki ci --ignore-scripts ``` Confirm first that no required dependency legitimately relies on an installation script. 7. Use a controlled dependency-update process that includes automated vulnerability scanning, integrity review, changelog inspection, and testing before lockfile updates are accepted. 8. Run documentation builds in a restricted environment with minimal filesystem access, no unnecessary secrets, and limited outbound network connectivity. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (18)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

Execute the analyzer script to scan the codebase and generate structured metadata. `<skill-root>` refers to the directory containing this `SKILL.md`.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/codewiki_bootstrap.py (reported line 26)May include surrounding context.

python

il
from pathlib import Path
import json


SCRIPT_DIR = Path(__file__).resolve().parent
SKILL_DIR = SCRIPT_DIR.parent
ASSETS_DIR = SKILL_DIR / "assets" / "vitepress"

REQUIRED_DIRS = [
    "getting-started",
    "architecture",
    "core-components",
    "development",
]

REQUIRED_FILES = {
    "overview.md": """# Overview\n\n```text\n# Related Code:\n- path/to/file\n```\n\n## One-Line Definition\n<!-- Replace with a one-sentence definition of the system. -->\n\n## Tech Stack Radar\n<!-- List core language, framework, infra, and key deps. -->\n\n## System Context Diagram\n<!-- Use Mermaid. -->\n""",
    "architecture/overview.md": """# Architecture Overview\n\n```text\n# Related Code:\n- path/to/file\n```\n\n## Design Rationale\n<!-- Explain why this architecture exists. -->\n""",
    "core-components/overview.md": """# Core Components Overview\n\n```text\n# Related Code:\n- path/to/file\n```\n\n## Component Map\n<!-- Summarize major components and why they exist. -->\n""",
    "develop

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/codewiki_bootstrap.py (reported line 115)May include surrounding context.

python

parser.add_argument("--repo-root", default=os.getcwd(), help="Repo root path")
    parser.add_argument("--out-dir", default="codewiki", help="Output directory")
    parser.add_argument("--no-copy-images", action="store_true", help="Skip copying image assets")
    parser.add_argument("--force", action="store_true", help="Overwrite existing files")
    parser.add_argument(
        "--refresh-sidebar",
        action="store_true",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill directs the agent to read the repository, write many files under codewiki/, and execute shell commands, but it declares no explicit tool scope or permission boundaries. This creates unnecessary risk because a host agent may grant broader file-system or shell access than intended, making accidental modification of unrelated files or execution in an unsafe environment more likely.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill recommends npx -p vitepress -p vitepress-plugin-mermaid -p mermaid vitepress dev codewiki, which pulls and executes packages at runtime without pinning versions. This is dangerous because it exposes users to supply-chain risk, including malicious or compromised upstream package releases being fetched and executed immediately.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/codewiki_analyze.py (reported line 117)May include surrounding context.

python

def _run(cmd: list[str], cwd: Path | None = None) -> tuple[int, str]:
    try:
        proc = subprocess.run(cmd, cwd=str(cwd) if cwd else None, capture_output=True, text=True)
        return proc.returncode, proc.stdout.strip()
    except FileNotFoundError:
        return 127, ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code invokes external tooling such as go, cargo, and swift to extract metadata, which can have side effects, leak information to toolchains, or execute in attacker-influenced environments. In a repository-analysis skill, silent execution of local build ecosystem tools is more dangerous because untrusted repositories may be analyzed and users may not realize code-adjacent tooling will run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The analysis pipeline recursively scans the repository, extracts structural details, symbols, dependencies, commands, and entrypoints, then serializes them for later use. That behavior can unintentionally collect and persist sensitive project intelligence, especially when used on private codebases where file names, service names, and architecture metadata are confidential.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script writes detailed repository metadata, symbol inventories, dependency lists, evidence, planning data, and generated documentation to disk automatically. In an agent skill context, that can expose sensitive internal structure, secrets-adjacent filenames, or proprietary architecture details into a new output tree without explicit user awareness or consent.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/codewiki_analyze.py (reported line 768)May include surrounding context.

python

]
    if force:
        cmd.append("--force")
    subprocess.run(cmd, check=False)


def refresh_sidebar(repo_root: Path, out_dir: Path, language: str) -> None:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/codewiki_analyze.py (reported line 783)May include surrounding context.

python

]
    if force:
        cmd.append("--force")
    subprocess.run(cmd, check=False)


def refresh_sidebar(repo_root: Path, out_dir: Path, language: str) -> None:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent to generate documentation directly into the repository's codewiki/ directory and later install dependencies there, but it does not clearly warn the user that local project contents will be created or modified. In this context the writes are expected, yet the lack of an explicit modification warning can still lead to unintended repository changes, noisy diffs, or accidental commits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The package manifest uses a wildcard version for mermaid, which makes builds non-reproducible and allows future installs to pull in any newly published version, including vulnerable or malicious releases. In a documentation-generation skill that depends on third-party rendering libraries, this increases supply-chain risk because the exact dependency version cannot be audited or consistently controlled.

Content

Scanner excerpt · assets/vitepress/package.json (reported line 11)May include surrounding context.

json

"docs:preview": "vitepress preview ."
  },
  "devDependencies": {
    "mermaid": "*",
    "vitepress": "*",
    "vitepress-plugin-mermaid": "*"
  }

Unverifiable Dependency: mermaid has 16 known advisory(ies) (CVE-2026-71436 (Mermaid XY Charts are vulnerable to an infinite loop DoS); CVE-2026-71437 (Mermaid Architecture diagrams are vulnerable to prototype pollution); CVE-2021-35513 (Cross-site Scripting in Mermaid) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

mermaid has known security advisories, and because the manifest does not pin a version, there is no way to verify whether the installed release is affected. In this skill's context, Mermaid will likely render diagram content derived from repositories, so known issues such as XSS, prototype pollution, or denial of service can become more relevant if untrusted content is processed during doc generation or preview.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The vitepress dependency is declared as *, so any version may be installed depending on when and where the package is resolved. This creates supply-chain and stability risk by preventing reproducible builds and making it possible to silently pick up vulnerable or compromised upstream releases.

Content

Scanner excerpt · assets/vitepress/package.json (reported line 12)May include surrounding context.

json

},
  "devDependencies": {
    "mermaid": "*",
    "vitepress": "*",
    "vitepress-plugin-mermaid": "*"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Using * for vitepress-plugin-mermaid leaves the plugin version uncontrolled, which is especially risky because plugins execute within the documentation toolchain and may process repository-controlled content. This can expose builds to newly introduced vulnerabilities or malicious package updates without any manifest change.

Content

Scanner excerpt · assets/vitepress/package.json (reported line 13)May include surrounding context.

json

"devDependencies": {
    "mermaid": "*",
    "vitepress": "*",
    "vitepress-plugin-mermaid": "*"
  }
}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script creates directories and writes multiple markdown files via mkdir() and write_text(), but there is no confirmation prompt, print/log message, or nearby comment warning the user that repository contents will be created or overwritten. Although this is a bootstrap utility, the code still performs direct filesystem changes and the only safeguard is the --force overwrite flag, which is not a user-facing disclosure at execution time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The function scans repository markdown, resolves local image references, and copies matching image files into the generated assets directory. This modifies the filesystem and potentially duplicates repository content, but the script does not emit any user-facing warning, logging, or inline documentation explaining that local assets will be copied unless --no-copy-images is set.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.