huodongyuan

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:23 AM UTC
• Version: 1.0.0

Overview

The skill appears intended for WeKan board management, but it installs an unpinned executable from a mutable GitHub repository while using an authenticated token and write access to board data.

Review this skill before installing. Use a dedicated least-privileged WeKan account, avoid admin tokens unless required, do not expose printed tokens in chat or logs, and prefer a version of the skill that pins the CLI dependency to a reviewed commit or release. Confirm board, list, and card IDs before letting an agent move, archive, restore, or delete anything.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Executable Dependency Installed from a Mutable Git Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-23
Vulnerability Type: Unpinned third-party executable dependency from a mutable source
Risk Level: Medium

json

"install": [
  {
    "id": "uv",
    "kind": "uv",
    "package": "wekan-cli @ git+https://github.com/madsmith/wekan_cli.git",
    "bins": ["wekancli"],
    "label": "Install Wekan CLI (uv)"
  }
],

Technical Analysis

The Skill directs uv to install wekan-cli directly from a Git repository without specifying an immutable commit hash, verified release version, or integrity checksum. Consequently, the effective package contents can change after this Skill has been reviewed without requiring any change to the audited repository.

The downloaded dependency is executable and operates with the environment variables WEKAN_URL and WEKAN_TOKEN. According to the accompanying documentation, it can read WeKan resources and create, edit, move, archive, restore, and potentially delete data. Installation may also execute package build or installation logic under the privileges of the process running uv.

No malicious content was identified in the audited Skill files themselves, and the external repository's contents were not included in the audit artifact. The vulnerability is therefore the unsafe and non-reproducible trust relationship, not a claim that the current upstream package is malicious.

Attack Path

1. An attacker compromises the referenced GitHub repository, gains control of its default branch, or causes an unsafe upstream update to be published.
2. The attacker adds malicious package installation logic or modifies the wekancli executable.
3. A user or Agent installs or reinstalls the Skill dependency using the unpinned Git URL.
4. uv retrieves the attacker-controlled repository state and installs or executes its package logic.
5. The malicious dependency runs with the local privileges of the installation ...[truncated 1208 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Git dependency to a reviewed, immutable full commit SHA rather than the repository's mutable default branch.
2. Prefer a verified release from an official package registry or an organization-controlled repository with release provenance.
3. Record and verify integrity metadata, such as cryptographic hashes or a lockfile, to make installation reproducible.
4. Audit the complete source and installation hooks of the exact pinned revision before approving it.
5. Enable automated dependency monitoring and require security review before updating the pinned revision.
6. Run installation and CLI operations in a sandbox with restricted filesystem, environment, and network access.
7. Provide only WEKAN_URL and WEKAN_TOKEN when needed, and prevent the dependency from inheriting unrelated secrets.
8. Use a dedicated, least-privileged WeKan account for the Agent. Avoid administrative roles and deletion privileges unless explicitly required.
9. Rotate the WeKan token if upstream compromise is suspected, and review WeKan audit records for unauthorized operations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/user-install.md (reported line 7)May include surrounding context.

md

- partial functionality with older versions
- Install the CLI from the github repo, this can be down in the openclaw Control interface under skills.
- Verify CLI is present with `wekancli --version`
- Use `wekancli login` to authenticate with your Wekan instance and acquire an access token
- It may be advisable to setup agent specific accounts for interacting with WeKan
- Delete APIs may only be invoked by users with the `admin` role

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description includes broad activation language such as handling 'anything Trelo-like' and task-board-related requests, which can cause the agent to invoke this skill in situations the user did not clearly intend. Because the skill can perform state-changing operations on a live Wekan server using an authenticated token, overbroad routing increases the chance of unauthorized or accidental modifications to boards, lists, or cards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quick-start section documents destructive operations such as moving and archiving cards without any caution, confirmation requirement, or note about reversibility. In an agent context, these examples normalize immediate execution of authenticated write operations and can lead to accidental data loss, workflow disruption, or unauthorized board changes if the skill is triggered incorrectly or used on the wrong IDs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation states that wekancli login prints a token and user ID, but provides no warning that the token is a secret that grants authenticated access. In agent or shared-terminal contexts, this increases the risk of accidental credential disclosure through logs, transcripts, shell history, screenshots, or copied output.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest frames this skill as managing Trello-like boards, cards, lists, and boards on a WeKan server. This reference also documents wekancli list users, explicitly noting it requires admin privileges, which is a broader account-enumeration capability not necessary for ordinary board management in the stated scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest describes using the skill to manage boards via wekancli, while this file documents an interactive login command that prompts for username/password and prints an authentication token. Credential-handling and token issuance are not mentioned in the skill purpose and are not obviously part of the end-user board-management workflow the manifest advertises.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.