Skip to content
skillsafebeta
← Report library
Purpose / Other

Weread Skills Skill Security Audit

What the author says it does (original text)

微信读书助手 — 搜索书籍、管理书架、查看笔记划线、浏览书评、阅读统计、发现推荐好书

Independent security check

Do not install or run it yet

Files checked
9
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Low risk

The Bearer API key and private reading data depend on one remote gateway

Source references: 6
What we found

The credential is sent to the gateway on every call and is bound to the user identity. The same gateway can retrieve bookshelf privacy flags, reading history, and personal note text. This boundary is necessary for the features, but the supplied material does not state key scope, revocation, or gateway retention policies.

Why this matters

If the key leaks or the gateway is untrusted, a holder may be able to query sensitive reading habits and personal writing as the user. The supplied evidence does not show that a leak occurred.

The remote gateway and identity-bound Bearer key are necessary to provide these features, but they still create a real credential and privacy boundary: the key is sent to one gateway and enables access to personal shelf, progress, and note/review data. The supplied material does not describe least-privilege scope, revocation, retention, or onward sharing, so users cannot determine the full impact of exposure from these documents. Users can ask for those policies and expose the environment variable only to the relevant session or process.

SKILL.md:33In the instructionsOpen original file
```POST https://i.weread.qq.com/api/agent/gateway```
Show 5 other places
SKILL.md:38In the instructionsOpen original file
- Header：`Authorization: Bearer $WEREAD_API_KEY`- `WEREAD_API_KEY` 从环境变量获取，格式 `wrk-xxxxxxxx`- 若未设置，提示用户：`export WEREAD_API_KEY=<你的apikey>`- API Key 绑定用户身份（vid），需要用户身份的接口会自动注入，无需手动传 vid
profile.md:31In the instructionsOpen original file
### 3. 获取笔记调 `/user/notebooks` 获取笔记概览，展示有笔记的书籍数和总笔记数。这里只做概览，不导出单本书笔记内容。如果用户要查看某本书的具体笔记内容，再按 `notes.md` 调 `/book/bookmarklist` 和 `/review/list/mine`。
notes.md:118In the instructionsOpen original file
|------|------|| `reviews` | 想法/点评数组 || `reviews[].review.reviewId` | 唯一 ID || `reviews[].review.content` | 内容文本 || `reviews[].review.abstract` | 想法对应的划线原文。仅划线想法等能定位到原文的内容有值，整本书评或章节点评可能为空或不存在 || `reviews[].review.range` | 划线原文位置范围，格式如 `"2959-3007"`。仅能定位到原文的内容有值 || `reviews[].review.chapterUid` | 章节 UID。章节相关内容可能有值 || `reviews[].review.chapterIdx` | 章节序号。章节相关内容可能有值 || `reviews[].review.createTime` | 创建时间 || `reviews[].review.star` | 评分（0-5，-1=无评分） |
profile.md:5In the instructionsOpen original file
通过组合 `/shelf/sync`、`/book/getprogress`、`/user/notebooks` 获取用户阅读概况。
notes.md:102In the instructionsOpen original file
### `/review/list/mine` — 单本书的个人想法与点评> 返回当前用户在该书上的所有个人内容，包括划线想法、章节点评和整本书评。
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Unvalidated server-provided deep links are presented as clickable links

Source references: 2
What we found

The Skill requires using `deepLink` directly from the response, without defining allowed schemes, domains, or target pages and without requiring validation before display.

Why this matters

If the API returns a malicious or altered link, clicking it could lead to phishing, invoke an unexpected app deep link, or prompt the user for permissions or credentials. The link is not opened automatically, so user interaction is required.

The Skill explicitly turns a server-returned `deepLink` into a clickable link as-is. It only forbids constructing a link when the field is absent; it provides no protocol, domain, or destination allowlist. A malicious or mistaken response could therefore send the user to an unexpected website or app scheme, although the material does not show that this has occurred. Users can ask for trusted HTTPS-domain or known WeRead-scheme validation and warnings for other targets.

SKILL.md:94In the instructionsOpen original file
8. **上下文衔接**：对话中记住已查询的 bookId，后续操作无需用户重复提供9. **深度链接**：优先使用接口回包中的 `deepLink` 字段作为跳转链接，展示为 `[打开阅读]({deepLink})`；若回包没有 `deepLink`，不要自行拼接 `weread://` 链接10. **数据展示规范**：
Show 1 other places
SKILL.md:103In the instructionsOpen original file
在展示书籍、章节、划线、想法等内容时，如果回包中有 `deepLink` 字段，直接使用该字段值作为跳转链接。- 跳转链接展示为 Markdown 超链接格式：`[打开阅读]({deepLink})`。- 各接口回包中可能包含 `deepLink` 字段，如有则直接使用。- 若回包中没有 `deepLink` 字段，不要尝试手动拼接 `weread://` 链接。
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
High risk

A server response can force the agent to follow unrestricted “upgrade” instructions

Source references: 2
What we found

Every request must inspect `upgrade_info`; if present, the agent must stop the user’s task and complete an upgrade according to the returned `message`. The document does not constrain allowed actions or require user confirmation or verification of the source, files, or commands.

Why this matters

If the gateway response is altered, the service is compromised, or the upgrade message is unsafe, remote text could become a high-priority instruction to download, install, or run content the user did not authorize.

This is an active mandatory rule, not an example: whenever the remote gateway returns `upgrade_info`, the agent must pause the user's task and carry out the upgrade directions in `message`. The material does not limit commands, download locations, or file changes that message may request, and does not require user approval. If the gateway or response is abused, server-provided text could steer the agent beyond WeRead queries. Users can ask for a fixed trusted upgrade source, an operation allowlist, and confirmation before installs or file changes.

SKILL.md:86In the instructionsOpen original file
1. **版本上报**：每次请求 body 必须包含 `"skill_version": "1.0.4"`（取本文件顶部 version 字段的值），用于服务端检查版本更新。**如果回包中出现 `upgrade_info` 字段，必须立即暂停当前操作，按照 `upgrade_info.message` 中的指引完成升级，升级完成后再重新执行用户请求，不得忽略该字段**2. **参数平铺**：业务参数必须和 `api_name`、`skill_version` 放在同一层；不要包在 `params`、`data`、`body` 等对象里。只有接口文档明确声明的数组/对象字段（如 `/book/readreviews` 的 `reviews`）才允许作为业务字段传入。
Show 1 other places
SKILL.md:33In the instructionsOpen original file
```POST https://i.weread.qq.com/api/agent/gateway```
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

The Skill sends all requests by POST to one WeRead gateway and supplies the environment API key as a Bearer credential. Because the key is bound to a user identity, the gateway can use it to return personal data.

View source
SKILL.md:33In the instructionsOpen original file
```POST https://i.weread.qq.com/api/agent/gateway```
SKILL.md:38In the instructionsOpen original file
- Header：`Authorization: Bearer $WEREAD_API_KEY`- `WEREAD_API_KEY` 从环境变量获取，格式 `wrk-xxxxxxxx`- 若未设置，提示用户：`export WEREAD_API_KEY=<你的apikey>`- API Key 绑定用户身份（vid），需要用户身份的接口会自动注入，无需手动传 vid

A personal reading overview combines the bookshelf, progress for the five most recently read ebooks, and notebook summaries, covering titles, reading times, progress, privacy flags, and note statistics.

View source
profile.md:5In the instructionsOpen original file
通过组合 `/shelf/sync`、`/book/getprogress`、`/user/notebooks` 获取用户阅读概况。
profile.md:12In the instructionsOpen original file
3. 书架数量必须按 `books.length + albums.length + (mp 非空 ? 1 : 0)` 计算；`albums[]` 是专辑/有声书，也属于书架里的书，不能只统计 `books[]`。4. 阅读进度只查最近 5 本电子书：从 `books[]` 按 `readUpdateTime` 降序取前 5 本，逐个调 `/book/getprogress`，避免大书架导致过多调用。5. 阅读时长字段单位为秒，展示时转为"X小时Y分钟"格式；Unix 时间戳展示为 `YYYY-MM-DD`。
shelf.md:31In the instructionsOpen original file
| `books[].category` | 分类 || `books[].readUpdateTime` | 最近阅读时间（Unix 时间戳） || `books[].finishReading` | 是否读完（1=读完） || `books[].updateTime` | 书籍更新时间 || `books[].isTop` | 是否置顶 || `books[].secret` | 是否私密（1=私密） || `albums[]` | 专辑/有声书数组（与 books 完全独立） |
notes.md:25In the instructionsOpen original file
|------|------|| `totalBookCount` | 有笔记的书籍总数 || `totalNoteCount` | 笔记总条数，统计口径为 `reviewCount + noteCount + bookmarkCount` 的汇总 || `hasMore` | 是否有更多（1=有） || `books[].bookId` | 书籍 ID || `books[].book` | 书籍信息（title, author, cover 等） || `books[].reviewCount` | 想法/点评数：包含划线想法、书评想法/个人点评、书摘、非书籍想法等个人内容 || `books[].noteCount` | 划线数（高亮标注的原文条数） || `books[].bookmarkCount` | 书签数（标记阅读位置的条数；只作为数量统计，当前不导出书签内容） || `books[].readingProgress` | 阅读进度 |

For “all note content” on one book, the Skill retrieves highlights and personal thoughts/reviews from two endpoints and merges them for display. This can include whole-book reviews, chapter comments, and other personal text.

View source
notes.md:102In the instructionsOpen original file
### `/review/list/mine` — 单本书的个人想法与点评> 返回当前用户在该书上的所有个人内容，包括划线想法、章节点评和整本书评。
notes.md:253In the instructionsOpen original file
1. **无参数/问笔记数量排行**：调 `/user/notebooks` 展示笔记本概览；如需完整排行，必须按 `count` + `lastSort` 遍历到 `hasMore=0`，且所有分页参数平铺在 body 顶层；每本书笔记数按 `reviewCount + noteCount + bookmarkCount` 计算并排序。2. **有 bookId 或书名，问单本书笔记内容**：同时调 `/book/bookmarklist`（划线内容）和 `/review/list/mine`（想法/点评内容），合并展示当前可导出的笔记内容。3. **明确要求书签内容**：说明当前接口只在 `/user/notebooks` 提供书签数量，不能导出书签内容；不要把划线误当书签。4. 用户从概览中选择某本书后，同样调上述两个接口。
notes.md:274In the instructionsOpen original file
- **统计笔记数 = `reviewCount + noteCount + bookmarkCount`**；不要把 `noteCount` 单独当作总笔记数。- **内容导出 = 划线内容 + 想法/点评内容**；当前不能导出书签内容。- `reviewCount` 已包含个人点评/书评想法，计算总笔记数时不要再额外加“点评数”。- 当用户说“所有笔记内容”时，必须同时查询 `/book/bookmarklist` 和 `/review/list/mine`，不能只返回划线。
Start here · InstructionsSKILL.md
weread-skills
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records9 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • book.mdFull text included
  • discover.mdFull text included
  • notes.mdFull text included
  • profile.mdFull text included
  • readdata.mdFull text included
  • review.mdFull text included
  • search.mdFull text included
  • shelf.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • book.mdSupporting file
  • discover.mdSupporting file
  • notes.mdSupporting file
  • profile.mdSupporting file
  • readdata.mdSupporting file
  • review.mdSupporting file
  • search.mdSupporting file
  • shelf.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:33In the instructionsOpen original file
```POST https://i.weread.qq.com/api/agent/gateway```
SKILL.md:50In the instructionsOpen original file
```bashcurl -X POST "https://i.weread.qq.com/api/agent/gateway" \  -H "Authorization: Bearer $WEREAD_API_KEY" \
Read keys or account settings
SKILL.md:38In the instructionsOpen original file
- Header：`Authorization: Bearer $WEREAD_API_KEY`- `WEREAD_API_KEY` 从环境变量获取，格式 `wrk-xxxxxxxx`
SKILL.md:39In the instructionsOpen original file
- Header：`Authorization: Bearer $WEREAD_API_KEY`- `WEREAD_API_KEY` 从环境变量获取，格式 `wrk-xxxxxxxx`- 若未设置，提示用户：`export WEREAD_API_KEY=<你的apikey>`
SKILL.md:40In the instructionsOpen original file
- `WEREAD_API_KEY` 从环境变量获取，格式 `wrk-xxxxxxxx`- 若未设置，提示用户：`export WEREAD_API_KEY=<你的apikey>`- API Key 绑定用户身份（vid），需要用户身份的接口会自动注入，无需手动传 vid
Run commands
SKILL.md:49In the instructionsOpen original file
```bashcurl -X POST "https://i.weread.qq.com/api/agent/gateway" \
Lines read
1,088
File checksum (to compare versions)
eeedd858835bee673fba6244e04a60c3887d27259b574dbbd4cb7f0dab82adbc