Security audit

WeryAI Chat

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its WeryAI chat purpose, but it has review-worthy risks around where the API key can be sent and what chat content can be logged.

Install only if you intend to send prompts to WeryAI's paid external API. Keep WERYAI_API_KEY in a trusted environment, do not set WERYAI_BASE_URL unless you fully trust the endpoint and use HTTPS, and avoid --verbose when prompts or responses may contain sensitive information. The unused balance/status helpers should be removed or clearly documented before broad deployment.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/vendor/weryai-text/cli.js:10
Finding: Unrestricted API Base URL Can Expose the WeryAI Bearer Credential
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/vendor/weryai-core/client.js:20
Finding: Verbose Logging Discloses Complete Chat Requests and Responses
Content: View full analysis
(typeof item === 'string' ? truncate(item) : item)); } else if (value && typeof value === 'object') { copy[key] = sanitizeForLog(value); } } return copy; } ``` ### Technical Analysis The sanitizer masks fields whose names resemble API keys or authorization headers and truncates several media-generation fields. Chat request and response text, however, is represented under fields such as: ```json { "messages": [ { "role": "user", "content": "Sensitive conversation text" } ] } ``` and: ```json { "choices": [ { "message": { "role": "assistant", "content": "Sensitive generate ...[truncated 1951 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description says this skill is for chatting with WeryAI chat models, inspecting models, comparing models, and sending chat-completions-style requests. The supplied code does none of that. Instead, it calls a balance endpoint and returns account credits/balance information. That is a materially different primary purpose and accesses a different resource category than declared. Therefore, the description does not accurately represent the code chunk's behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This code does not match the declared purpose of a WeryAI chat-model skill. The module is focused on post-processing asynchronous task objects: normalizing statuses, content statuses, arrays/strings, scripts, and determining aggregate batch phases. Its data model includes media outputs and task metadata rather than chat prompts, messages, completions, or model metadata. While normalization helpers could be supporting utilities in a broader SDK, this specific chunk’s actual behavior is materially different from the declared primary purpose and exposes capabilities oriented toward task/media result handling rather than chat interactions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill is for chatting with WeryAI chat models through an OpenAI-compatible chat completions API. However, the supplied code does not send chat prompts, manage conversations, inspect models, compare models, or call chat completions endpoints. Instead, it checks the status of generation tasks or batches using task IDs/batch IDs and returns normalized job results, including media/output-oriented fields like lyrics and coverUrl. That is a materially different primary purpose, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is about interactive chat with WeryAI chat models via an OpenAI-compatible chat completions API. The supplied code does not perform chat completion requests, model lookup, conversation handling, or message-array submission. Instead, it waits for asynchronous generation jobs to finish by polling task and batch status endpoints under /v1/generation/.../status. It also processes task completion/failure states and output artifacts like lyrics and cover URLs, which are unrelated to general chat functionality. This is a materially different primary purpose, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description claims a user-facing skill for interacting with WeryAI chat models through an OpenAI-compatible API. However, the provided code chunk only provides infrastructure for a command-line wrapper: flag parsing, JSON/stdin input resolution, environment-based configuration, handler invocation, and output/error formatting. While the context includes WeryAI-related environment variables such as API key, base URL, and default model, the code does not actually contact the API or perform any chat/model operations. That is a material description-behavior mismatch for this chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description presents this skill as an API-facing tool for interacting with WeryAI chat models, including asking/chatting, comparing models, inspecting models, and direct chat-completions usage. The supplied code chunk does not implement those core capabilities. Instead, it is a helper module that defines prompt presets and utility functions to normalize inputs, validate parameters, and build message payloads for assorted writing tasks. While the code is consistent with part of the description around prompt-response tasks and direct message-array handling, it materially lacks any code for model discovery, comparison, inspection, or making requests to an OpenAI-compatible API. It also emphasizes specialized content-writing workflows not highlighted as the primary declared purpose. Therefore the declared description overstates and partially misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares network access and use of an API key in metadata but does not define an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for the runtime or reviewers to constrain what the skill may access, increasing the chance of unintended outbound requests or secret exposure through overly broad execution capabilities.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description is very broad and matches generic chat requests, which can cause over-invocation on ordinary user conversations. In a system with network access and paid API usage, overly broad triggering can lead to unnecessary external data disclosure, surprise credit consumption, and routing around more specialized or safer local skills.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This file adds a balance-retrieval capability even though the skill is described as a chat/model-inspection integration. That scope mismatch matters because it expands access to account-level financial metadata that users and reviewers may not expect, increasing the chance of unauthorized information disclosure or misuse through the agent interface.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Calling '/v1/generation/balance' exposes account balance information that is unrelated to normal chat completions behavior. In an agent setting, this creates an unnecessary sensitive capability that could leak billing state, enable account reconnaissance, or be triggered by prompts that users would not reasonably expect to touch account data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code posts requestBody to /v1/chat/completions, and that payload includes messages built from user input. Within this file there is no confirmation prompt, logging, or explanatory comment/docstring warning that user-provided content will be transmitted to an external API.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The phrase "when the user wants general assistant chat" is very broad and does not clearly define boundaries for when this skill should activate versus other general-purpose skills. Because AGENTS.md is a markdown file, this falls under vague trigger guidance and may lead to unintended routing for common everyday requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The code accesses sensitive environment variables including an API key and related service configuration, but this file provides no user-facing warning, prompt, or explanatory comment about using those credentials. For code files, accessing sensitive credentials can warrant a disclosure unless the behavior is clearly explained elsewhere, which is not evident in this file.
Content: No source excerpt is available for this finding.