Security audit

Wekan

Security checks for vulnerabilities and agentic risk

Overview

The skill is for legitimate WeKan board management, but it can modify live boards with a token and has weak scoping, under-disclosed destructive actions, and an unpinned Git-installed CLI.

Review before installing. Use a dedicated least-privileged WeKan account, avoid admin tokens, confirm all create/move/archive/delete actions before execution, do not expose login token output in chat or logs, and prefer a pinned reviewed CLI revision.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Third-Party Git Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15–23 **Vulnerability Type**: Unpinned dependency retrieved from a mutable Git source **Risk Level**: Medium ### Vulnerable Code ```json "install": [ { "id": "uv", "kind": "uv", "package": "wekan-cli @ git+https://github.com/madsmith/wekan_cli.git", "bins": ["wekancli"], "label": "Install Wekan CLI (uv)" } ], ``` ### Technical Analysis The Skill installs `wekan-cli` directly from a GitHub repository without specifying an immutable commit hash, signed release, version tag, or integrity digest. Consequently, the code installed in the future may differ from the code reviewed when this Skill was published. The upstream dependency is not included in the audited project, so its installation logic and runtime behavior could not be verified during this audit. If the repository, its default branch, or a maintainer account is compromised, an attacker could introduce malicious installation or runtime code. That code would then be retrieved and executed through the configured `uv` installation mechanism. This is a supply-chain weakness rather than evidence that the current upstream package is malicious. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of modifying its default branch. 2. The attacker adds malicious package installation or runtime logic to the repository. 3. A user installs or reinstalls the Skill dependency using the declared mutable Git URL. 4. `uv` retrieves and installs the attacker-controlled revision. 5. The malicious code executes during installation or when the agent invokes `wekancli`. 6. The code may access the environment and process context available to the CLI, including `WEKAN_URL` and `WEKAN_TOKEN`, and may perform operations using the associated WeKan identity. ### Impact Assessment Successful exploitation would execute code with the operating-system privileges of the ...[truncated 583 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the Git dependency to a reviewed, immutable commit SHA, for example: ```text wekan-cli @ git+https://github.com/madsmith/wekan_cli.git@<reviewed-commit-sha> ``` 2. Prefer a signed, immutable release from a trusted package registry when available. 3. Verify package hashes or other integrity metadata during installation. 4. Review the pinned dependency source, including build and installation hooks, before approving it. 5. Use automated dependency monitoring to identify security advisories and intentional pin updates. 6. Run the CLI under a dedicated, least-privileged operating-system account. 7. Configure an agent-specific WeKan account with only the board permissions required for its tasks; avoid administrative tokens. 8. Rotate `WEKAN_TOKEN` immediately if dependency compromise is suspected, and review WeKan audit records for unauthorized activity. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

Category: Privilege Escalation
Content: - partial functionality with older versions - Install the CLI from the github repo, this can be down in the openclaw Control interface under skills. - Verify CLI is present with `wekancli --version` - Use `wekancli login` to authenticate with your Wekan instance and acquire an access token - It may be advisable to setup agent specific accounts for interacting with WeKan - Delete APIs may only be invoked by users with the `admin` role
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger text is broad enough to activate on generic 'board' or Trello-like task discussions, which can cause the agent to invoke this skill in situations the user did not specifically intend. Because the skill performs state-changing actions against a live Wekan instance using an authenticated token, accidental activation can lead to unintended data modification or disclosure of board contents.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill documents destructive operations like moving and archiving cards without any warning, guardrails, or confirmation requirements. In an agent context, this increases the chance that a model will directly execute irreversible or disruptive actions against user boards, especially when coupled with a preconfigured authentication token.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation states that `wekancli login` prints a token and user ID, but provides no warning not to expose that token in logs, chat output, transcripts, or telemetry. In an agent context, this is dangerous because the model may surface command output verbatim, leaking a reusable authentication secret that can enable unauthorized access to the WeKan instance.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest says the skill manages WeKan by creating, moving, and archiving cards, lists, and boards. This reference file additionally documents `wekancli delete` operations, which are materially more destructive than the stated scope and are not mentioned in the manifest description.

Description-Behavior Mismatch

Low

Confidence: 83% confidence
Finding: The manifest frames the skill as a board-management tool for Trello-like operations on boards, lists, and cards. This file also documents authentication (`login`) and account/user retrieval and enumeration (`get user`, `list users`), which are broader administrative/account capabilities not described in that manifest summary.

Static analysis

No suspicious patterns detected.