Security audit

huodongyuan

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for WeKan board management, but it installs an unpinned executable from a mutable GitHub repository while using an authenticated token and write access to board data.

Review this skill before installing. Use a dedicated least-privileged WeKan account, avoid admin tokens unless required, do not expose printed tokens in chat or logs, and prefer a version of the skill that pins the CLI dependency to a reviewed commit or release. Confirm board, list, and card IDs before letting an agent move, archive, restore, or delete anything.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Executable Dependency Installed from a Mutable Git Repository## Vulnerability Details **File Location**: `SKILL.md`, lines 15-23 **Vulnerability Type**: Unpinned third-party executable dependency from a mutable source **Risk Level**: Medium ```json "install": [ { "id": "uv", "kind": "uv", "package": "wekan-cli @ git+https://github.com/madsmith/wekan_cli.git", "bins": ["wekancli"], "label": "Install Wekan CLI (uv)" } ], ``` ### Technical Analysis The Skill directs `uv` to install `wekan-cli` directly from a Git repository without specifying an immutable commit hash, verified release version, or integrity checksum. Consequently, the effective package contents can change after this Skill has been reviewed without requiring any change to the audited repository. The downloaded dependency is executable and operates with the environment variables `WEKAN_URL` and `WEKAN_TOKEN`. According to the accompanying documentation, it can read WeKan resources and create, edit, move, archive, restore, and potentially delete data. Installation may also execute package build or installation logic under the privileges of the process running `uv`. No malicious content was identified in the audited Skill files themselves, and the external repository's contents were not included in the audit artifact. The vulnerability is therefore the unsafe and non-reproducible trust relationship, not a claim that the current upstream package is malicious. ### Attack Path 1. An attacker compromises the referenced GitHub repository, gains control of its default branch, or causes an unsafe upstream update to be published. 2. The attacker adds malicious package installation logic or modifies the `wekancli` executable. 3. A user or Agent installs or reinstalls the Skill dependency using the unpinned Git URL. 4. `uv` retrieves the attacker-controlled repository state and installs or executes its package logic. 5. The malicious dependency runs with the local privileges of the installation ...[truncated 1208 chars]
Remediation: ## Remediation Suggestions 1. Pin the Git dependency to a reviewed, immutable full commit SHA rather than the repository's mutable default branch. 2. Prefer a verified release from an official package registry or an organization-controlled repository with release provenance. 3. Record and verify integrity metadata, such as cryptographic hashes or a lockfile, to make installation reproducible. 4. Audit the complete source and installation hooks of the exact pinned revision before approving it. 5. Enable automated dependency monitoring and require security review before updating the pinned revision. 6. Run installation and CLI operations in a sandbox with restricted filesystem, environment, and network access. 7. Provide only `WEKAN_URL` and `WEKAN_TOKEN` when needed, and prevent the dependency from inheriting unrelated secrets. 8. Use a dedicated, least-privileged WeKan account for the Agent. Avoid administrative roles and deletion privileges unless explicitly required. 9. Rotate the WeKan token if upstream compromise is suspected, and review WeKan audit records for unauthorized operations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

Category: Privilege Escalation
Content: - partial functionality with older versions - Install the CLI from the github repo, this can be down in the openclaw Control interface under skills. - Verify CLI is present with `wekancli --version` - Use `wekancli login` to authenticate with your Wekan instance and acquire an access token - It may be advisable to setup agent specific accounts for interacting with WeKan - Delete APIs may only be invoked by users with the `admin` role
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill description includes broad activation language such as handling 'anything Trelo-like' and task-board-related requests, which can cause the agent to invoke this skill in situations the user did not clearly intend. Because the skill can perform state-changing operations on a live Wekan server using an authenticated token, overbroad routing increases the chance of unauthorized or accidental modifications to boards, lists, or cards.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The quick-start section documents destructive operations such as moving and archiving cards without any caution, confirmation requirement, or note about reversibility. In an agent context, these examples normalize immediate execution of authenticated write operations and can lead to accidental data loss, workflow disruption, or unauthorized board changes if the skill is triggered incorrectly or used on the wrong IDs.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation states that `wekancli login` prints a token and user ID, but provides no warning that the token is a secret that grants authenticated access. In agent or shared-terminal contexts, this increases the risk of accidental credential disclosure through logs, transcripts, shell history, screenshots, or copied output.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The manifest frames this skill as managing Trello-like boards, cards, lists, and boards on a WeKan server. This reference also documents `wekancli list users`, explicitly noting it requires admin privileges, which is a broader account-enumeration capability not necessary for ordinary board management in the stated scope.

Context-Inappropriate Capability

Low

Confidence: 76% confidence
Finding: The manifest describes using the skill to manage boards via `wekancli`, while this file documents an interactive `login` command that prompts for username/password and prints an authentication token. Credential-handling and token issuance are not mentioned in the skill purpose and are not obviously part of the end-user board-management workflow the manifest advertises.

Static analysis

No suspicious patterns detected.