Wavye

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:28 AM UTC
• Version: 1.0.13

Overview

This appears to be a legitimate Wayve integration, but it broadly reads, stores, and changes sensitive planning and business data with insufficient scoping and safeguards.

Review this carefully before installing. Only use it if you are comfortable giving the Wayve CLI access to read and change your planning data and to store long-term personal, schedule, health, family, coaching, and business context in your Wayve account. Prefer explicit confirmation before saving sensitive memories or creating automations, avoid pasting secrets into command lines, and consider pinning the CLI to a reviewed version.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: references/onboarding.md:49
• Finding: Shell Command Injection Through Unsafely Interpolated User Data<![CDATA[ ## Vulnerability Details **File Locations**: - `references/onboarding.md:49-56` - `references/time-audit.md:91-94` - `references/time-audit.md:172-174` - `references/nightly-analysis.md:32-36` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code `references/onboarding.md:49-56`: ```bash wayve knowledge save --category "personal_context" --key "business_type" --value "Design agency, solopreneur" --json wayve knowledge save --category "personal_context" --key "business_clients" --value "6 active clients, mostly SaaS startups" --json wayve knowledge save --category "personal_context" --key "business_tools" --value "Figma, Slack, Notion, Gmail" --json wayve knowledge save --category "personal_context" --key "business_pain_points" --value "Client communication takes ~50% of work time" --json wayve knowledge save --category "personal_context" --key "business_goals" --value "Get to 10 clients by June, launch online course" --json wayve knowledge save --category "personal_context" --key "business_capacity" --value "Can handle max 6 clients simultaneously" --json wayve knowledge save --category "personal_context" --key "revenue_monthly" --value "~€5000/month" --json // only if shared ``` `references/time-audit.md:91-94`: ```bash wayve knowledge save --category "personal_context" --key "timezone" --value "USER_TIMEZONE" --json wayve knowledge save --category "personal_context" --key "active_hours" --value "Mon-Thu HH:MM-HH:MM, Fri-Sun HH:MM-HH:MM" --json wayve knowledge save --category "preferences" --key "time_audit_config" --value "audit_id: AUDIT_ID, interval: 30min, channel: telegram, duration: 7 days, start: YYYY-MM-DD, end: YYYY-MM-DD" --json ``` `references/time-audit.md:172-174`: ```bash wayve audit log --audit "AUDIT_ID" --what "gym" --energy 4 --pillar "matched-pillar-uuid" --value 1 --note "optional note" --json ``` `references/nightly-analysis.md:32-36`: ```bash wayve automations create agent_routine --na ...[truncated 2504 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct shell command strings from user-controlled values. 2. Invoke the CLI through an execution API that accepts an argument array without a shell, for example: - Executable: `wayve` - Arguments: `["knowledge", "save", "--category", category, "--key", key, "--value", value, "--json"]` 3. Serialize `--config` and `--delivery-config` values with a trusted JSON encoder rather than manual string interpolation. 4. Validate constrained fields with allowlists: - Delivery channels against supported channel names. - UUIDs against a strict UUID format. - Dates and times against fixed formats. - Timezones against an IANA timezone database. - Numeric ratings and intervals against documented ranges. 5. If a shell cannot be avoided, apply a proven shell-escaping routine to every dynamic argument. Manual quoting is not sufficient. 6. Add adversarial tests covering apostrophes, backticks, command substitutions, semicolons, newlines, and malformed JSON. 7. Run the CLI in a restricted environment with minimal filesystem, network, and environment-variable access to reduce impact if injection occurs. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Mutable and Unverified npm CLI Dependency<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:14-17` - `references/setup-guide.md:5-14` - `references/setup-guide.md:74` **Vulnerability Type**: Unpinned third-party dependency and supply-chain execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:14-17`: ```yaml install: - kind: node package: "@gowayve/wayve-cli@latest" bins: - wayve ``` `references/setup-guide.md:5-14`: ```bash npm install -g @gowayve/wayve-cli ``` Or use without installing: ```bash npx @gowayve/wayve-cli ``` `references/setup-guide.md:74`: ```markdown **"wayve: command not found":** Install the CLI globally with `npm install -g @gowayve/wayve-cli`, or use `npx @gowayve/wayve-cli` to run without installing. Make sure Node.js 18+ is installed (`node --version`). ``` ### Technical Analysis The Skill explicitly installs `@gowayve/wayve-cli@latest`, while the setup instructions use an unversioned global npm installation or `npx`. These forms resolve to a mutable package release at execution time rather than a version reviewed together with the Skill. npm packages can execute package code and lifecycle scripts with the permissions of the installing user. `npx` can download and execute a package immediately. Consequently, the effective executable may change after this Skill has been audited without any modification to the repository. The package scope is consistent with the declared Wayve vendor, so the audit did not identify definite typosquatting or dependency confusion. The risk arises from mutable resolution, lack of integrity pinning, and immediate execution of third-party code. ### Attack Path 1. The npm publisher account, registry package, release process, or a transitive dependency is compromised. 2. A malicious version becomes the package's current default or `latest` release. 3. A user installs the CLI using the Skill metadata, global npm command, or `npx`. 4. npm downloads and executes the changed package or its lifecycle script ...[truncated 724 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to an exact audited version rather than `@latest`, for example `@gowayve/wayve-cli@X.Y.Z`. 2. Publish and verify package integrity hashes or signed provenance before installation. 3. Maintain a lockfile for any local installation and pin transitive dependencies. 4. Avoid automatic `npx` execution of an unpinned package. 5. Disable npm lifecycle scripts where the package can operate without them, or audit every required lifecycle script. 6. Document a controlled update process in which new CLI versions are reviewed and tested before the Skill metadata is updated. 7. Run the CLI with minimum operating-system permissions and expose only the specific credential and data access it requires. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/automations.md:83
• Finding: Notification Credentials Exposed Through Process Arguments and Plaintext Shell Handling<![CDATA[ ## Vulnerability Details **File Locations**: - `references/automations.md:83-110` - `references/automations.md:122-137` - `references/setup-guide.md:24-32` - `references/setup-guide.md:78` **Vulnerability Type**: Insecure secret handling **Risk Level**: Medium ### Vulnerable Code `references/automations.md:83-110`: ```bash wayve automations create morning_brief --cron "30 7 * * *" --timezone Europe/Amsterdam --channel telegram --delivery-config '{"bot_token":"YOUR_TOKEN","chat_id":"YOUR_CHAT_ID"}' --json ``` ```bash wayve automations create morning_brief --cron "30 7 * * *" --timezone Europe/Amsterdam --channel discord --delivery-config '{"webhook_url":"https://discord.com/api/webhooks/..."}' --json ``` ```bash wayve automations create morning_brief --cron "30 7 * * *" --timezone Europe/Amsterdam --channel slack --delivery-config '{"webhook_url":"https://hooks.slack.com/services/..."}' --json ``` ```bash wayve automations create morning_brief --cron "30 7 * * *" --timezone Europe/Amsterdam --channel email --delivery-config '{"email":"[e-mail]"}' --json ``` `references/automations.md:122-137`: ```markdown 4. **Ask explicit permission before collecting credentials**: Explain exactly what data you need (e.g., bot token + chat ID for Telegram), why you need it (to deliver notifications), and how it's stored (encrypted with AES-256-GCM, deletable anytime by removing the automation). **Never collect or pass credentials without the user explicitly confirming.** If the user declines, offer the `pull` channel instead (no credentials needed). 5. **Collect channel credentials** if the user agreed — guide them through getting the token/webhook (see Channel Setup Details above) 6. **Create the bundle or individual automations** via CLI commands, passing `--delivery-config` with the credentials 7. **Confirm**: Show what was created with schedules ``` ```bash wayve automations bundle starter --timezone Europe/Amsterdam --channel telegram --delivery-co ...[truncated 2604 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not pass credentials in command-line arguments. 2. Add CLI support for one of the following: - Reading delivery configuration from standard input. - Reading secrets from a permission-restricted file. - Retrieving secrets from an operating-system keychain. - An interactive secret prompt that disables terminal echo. 3. Ensure agent and CLI logs redact tokens, webhook URLs, API keys, authorization headers, and delivery configuration. 4. Replace `echo $WAYVE_API_KEY` with a non-disclosing presence check, such as testing whether the variable is set or using `wayve auth status`. 5. Recommend an OS keychain or dedicated secret manager instead of plaintext shell-profile storage. 6. Apply restrictive file permissions if a configuration file is unavoidable. 7. Rotate credentials immediately after suspected exposure and document revocation procedures for every supported channel. 8. Preserve the existing explicit-consent requirement and clearly distinguish local secret exposure from server-side encrypted storage. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:30
• Finding: Overbroad Mandatory Collection and Server-Side Persistence of Sensitive User Data<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:30-41` - `SKILL.md:98-104` - `SKILL.md:198-206` - `references/onboarding.md:31-57` - `references/onboarding.md:178-192` - `references/knowledge-learning.md:1-19` - `references/knowledge-learning.md:29-48` - `references/time-audit.md:11-20` **Vulnerability Type**: Excessive remote data access and persistence beyond minimum privilege **Risk Level**: Medium ### Vulnerable Code `SKILL.md:30-41`: ```markdown This skill depends on the **Wayve CLI** (`wayve` command) to function. Without it, you cannot save settings, log entries, create audits, store knowledge, or retrieve user data. **Every flow in this skill requires running wayve CLI commands — never skip them.** If a CLI command fails, tell the user and retry. Do not continue the flow without actually saving the data. **How to run CLI commands:** Use the Bash tool with the `wayve` command. Always append `--json` for machine-readable output that you can parse and use in conversation. Key commands you must actively use: - `wayve knowledge summary/list/save/update/delete --json` — save and retrieve user insights, preferences, and context. Run this to persist everything you learn. - `wayve audit start/log/report --json` — create audits, log entries, generate reports. Every check-in response must be logged. - `wayve context --json` — fetch the user's current pillars, activities, and schedule. - `wayve activities create/update --json` — create and modify activities in the user's plan. - `wayve settings get/update --json` — save user preferences (calendar hours, sleep schedule, etc.). **If you note something but don't run a command to save it, it's lost.** Always persist data through CLI commands. ``` `SKILL.md:98-104`: ```markdown **Two mandatory first steps** (every session, before giving advice): 1. Run `wayve context --json` — get pillars, activities, schedule 2. Run `wayve knowledge summary --json` — get stored insights about this user Refere ...[truncated 5624 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace blanket persistence with explicit, category-specific opt-in consent. 2. Provide a session-only or local-processing mode that does not upload conversational information. 3. Before saving sensitive information, show: - The exact value or a concise preview. - Its category and purpose. - The retention period. - How to delete or export it. 4. Treat health, family, financial, crisis, and inferred coaching data as sensitive categories requiring separate confirmation. 5. Retrieve only the minimum categories required for the current action rather than the complete context and knowledge summary at every session. 6. Avoid mandatory retrieval for simple direct operations that do not require historical personalization. 7. Establish retention limits and automatic expiration for raw activity logs, audit entries, commitments, and transient observations. 8. Allow users to disable inference-based coaching themes and automatic pattern storage. 9. Make deletion and export controls available before collection, not only after data has been stored. 10. Document server-side access controls, encryption in transit and at rest, breach handling, and account-deletion behavior. 11. Minimize stored values by using coarse summaries where detailed raw information is unnecessary. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (42)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The skill description says to use the skill whenever users mention broad themes like planning, automations, business strategy, or getting more out of their agent, even without explicitly saying “Wayve.” That creates an over-broad trigger surface where ordinary conversation may invoke a tool-backed skill unexpectedly, causing unintended access to external systems and user data.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

### What NOT to Do
- Don't be a financial advisor — you're a strategic thinking partner
- Don't judge revenue levels — €2000/month and €20000/month are both valid
- Don't push growth if the user is content with their current level
- Don't track expenses, profit margins, or tax — that's outside Wayve's scope
- Always respect if the user doesn't want to share financial details

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The documented categories explicitly include sensitive medical conditions, family situation, relationship details, and detailed financial data, yet the skill metadata and workflow do not provide a strong upfront warning that such data may be persistently stored server-side. That omission is dangerous because users may disclose highly sensitive information in ordinary conversation without understanding the storage, retention, and cross-session reuse implications.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The instructions direct the agent to save sensitive health, financial, family, and crisis-related information from normal conversations into persistent memory. Persistently storing these categories without strict necessity and explicit informed consent materially increases privacy, profiling, and potential compliance risks, especially if data is later reused or exposed.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The workflow instructs the agent to create activities and set recurring habits without any confirmation step. Because this directly changes the user's planning system and can create ongoing recurring commitments, accidental or overbroad execution could materially disrupt schedules and trust in the assistant.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

User says "wrap up", "review my week", "how did my week go", or it's Sunday context.

## Your Approach
Celebratory and learning-focused. Lead with "what worked?" not "what failed?" The goal is reflection without judgment — awareness, not guilt.

## Flow

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to persist essentially everything it learns and says every flow requires CLI-backed saving, with language like “persist everything you learn.” This creates excessive long-term retention of potentially sensitive personal, behavioral, scheduling, and business data without clear minimization, purpose limitation, or per-item consent.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The default `/wayve` behavior tells the agent to “use your judgment,” which leaves the scope of actions under-specified for a tool that can retrieve context, read long-term memory, and create or modify user data. Ambiguous default behavior increases the chance of over-collection, over-sharing, or performing operations the user did not clearly request.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill requires retrieving `wayve knowledge summary` at the start of every session and referencing a stored insight in the first substantive response. This unnecessarily exposes prior personal data in unrelated conversations and normalizes broad background access even when the user’s current request does not need it.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The continuous-learning section explicitly directs the agent to save personal context, financial data, corrections, and recurring patterns as part of ordinary conversation. In a coaching/productivity skill focused on life pillars, this context is especially sensitive because it can include health, mindset, relationships, finances, and behavioral trends, increasing privacy and profiling risk if over-retained or misused.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Telegram:**
1. Create a bot via @BotFather, get the bot token
2. Start a chat with your bot, send a message
3. Get your chat_id via `https://api.telegram.org/bot<TOKEN>/getUpdates`
4. Pass via CLI:
```bash
wayve automations create morning_brief --cron "30 7 * * *" --timezone Europe/Amsterdam --channel telegram --delivery-config '{"bot_token":"YOUR_TOKEN","chat_id":"YOUR_CHAT_ID"}' --json

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The playbook directs the agent to observe, infer, and save personal behavioral themes across sessions without requiring a clear, prior consent flow or prominent privacy notice at the point of collection. In a coaching context, these inferred labels can become sensitive profiling data and may surprise users if retained persistently.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The document explicitly instructs saving crisis-event details, what happened, and how the user coped for future recall across sessions. Life events such as illness, breakup, or family emergency are highly sensitive personal data; persisting them in plain-language notes materially raises privacy harm if exposed, misused, or retained longer than necessary.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This section instructs the agent to collect and save revenue, client count, pricing, and revenue targets, which are sensitive business data, but does not require a clear upfront privacy disclosure or explicit consent before persistence. Persistent storage of financial/business context increases confidentiality risk and may violate user expectations if handled implicitly during coaching.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: This section promotes ongoing collection and storage of personal and financial data in the knowledge base, including revenue, client count, targets, and pricing. Cross-session accumulation of sensitive business information creates a richer target for misuse or breach and increases the consequences of unauthorized access.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation rule is overly broad because it triggers not only on explicit commands like 'fresh start' or 'plan my week' but also on vague phrases like 'let's plan' and any 'Monday context.' In an agent skill, ambiguous invocation can cause the skill to activate unexpectedly, leading to unintended access to personal planning context, memory, and scheduling actions that the user did not clearly request.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The file frames the product's value around persistent memory that stores planning insights across devices, sessions, and AI clients, encouraging broad retention and reuse beyond narrow task necessity. This is risky because it normalizes accumulation of longitudinal user profiles that may exceed what is needed for the immediate interaction and expands the privacy blast radius if mishandled.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The file mandates automatic retrieval and use of server-side stored personal knowledge at the start of every planning interaction, but does not require meaningful, session-time notice or consent before resurfacing prior personal data. This creates a privacy risk because highly personal context can be used unexpectedly across sessions and clients, increasing the chance of inappropriate disclosure, over-collection, or user surprise.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The 'During Any Conversation' section tells the agent to systematically harvest personal disclosures, frustrations, preferences, and repeated blockers for later storage. This is dangerous because it turns ordinary conversation into ongoing profile extraction without requiring contemporaneous notice, necessity checks, or user approval for each memory action.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### When to update vs. create new
- **Update** when new data refines an existing insight (e.g., adding a 4th week of data to a trend)
- **Create new** when it's a genuinely different insight in the same category
- **Delete** — When you believe an insight is outdated or wrong, ask the user: 'This insight seems outdated — want me to update or remove it?' Only delete without asking when the user explicitly requests it ('forget that', 'delete that').

---

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The end-of-session checklist and mandatory retrieval workflow encourage continual accumulation of user information and require resurfacing at least one stored insight in future sessions. This creates a compounding privacy risk by incentivizing the system to keep expanding the user's profile and to reuse it by default, even when not strictly needed for the current request.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger phrases are broad enough that a user asking for a general self-review could invoke this skill unintentionally. In this skill's context, unintended invocation is more concerning because the flow later instructs the agent to read extensive personal data and perform writes, so accidental activation can cascade into privacy-impacting and state-changing actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instruction to save milestone observations to knowledge creates persistent records without telling the user or asking permission. This is dangerous because it silently transforms a conversational analysis into durable profiling, which can surprise users and retain sensitive personal inferences across sessions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Creating and resurfacing suggestions modifies stored planning data, yet the workflow does not warn the user that it will do so. In a coaching/planning skill, these writes can alter the user's task environment and future prompts, making the issue more than a cosmetic change.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Saving major patterns, delegation candidates, happiness correlations, and balance recommendations to knowledge persists sensitive behavioral inferences without disclosure. In this life-audit context, the data is especially intimate, so silent storage increases privacy risk and may influence future agent behavior in ways the user did not intend.

Static analysis

No suspicious patterns detected.