read-weread-coach
Fail
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The notification logic in
scripts/pick_review.pyis vulnerable to AppleScript injection. The script constructs a command forosascriptusing string interpolation of book titles and text directly from the WeRead API. Because these titles are not sanitized, a crafted book title (e.g., using AppleScript'sdo shell script) could execute arbitrary shell commands on the host machine when a notification is triggered. - [DATA_EXFILTRATION]: The skill caches sensitive user data, including book highlights and reviews, in the
/tmp/read-weread-coach/directory. On multi-user systems, files in/tmpare often globally readable, posing a risk of local data exposure. - [EXTERNAL_DOWNLOADS]: The skill fetches user notebooks, bookmarks, and reviews from the official Tencent WeRead API service at
i.weread.qq.com. - [COMMAND_EXECUTION]: The
pick_review.pyscript usessubprocess.runto callosascriptfor displaying desktop notifications.
Recommendations
- AI detected serious security threats
Audit Metadata