KibiConnect Wiki Documentation

The `upload_image` Python helper function reads content from an arbitrary `file_path` and sends it to an external API endpoint with the API key, enabling exfiltration of any file readable by the agent if the `file_path` argument can be controlled by an attacker.

with open(file_path, "rb") as f: file_data = f.read() ... urllib.request.Request(f"{BASE_URL}/media/upload", data=body, headers={"Authorization": f"Bearer {API_KEY}", ...})

The skill explicitly instructs the agent to execute a shell command (`./vendor/bin/sail artisan kibi:setup --demo`), demonstrating the agent's capability to run arbitrary commands which could be exploited for malicious purposes.

Use `./vendor/bin/sail artisan kibi:setup --demo` for base data

The skill instructs the agent to generate and write a Python helper module to `/tmp/wiki_helpers.py` and implicitly execute it. This pattern allows for arbitrary code injection and execution if the agent can be prompted to modify the Python code before writing.

For creating wiki content, generate a Python helper module in `/tmp/wiki_helpers.py`. This is the recommended approach...

The instruction to use `browser_take_screenshot` could lead to the capture of sensitive information if the agent is manipulated into navigating to a confidential page or fails to dismiss overlays, potentially leading to data exfiltration.

Use browser_take_screenshot with appropriate viewport

The skill uses `urllib.request` to interact with an external API, including an API key in the `Authorization` header. This makes the API key vulnerable to exposure if the agent is tricked into logging requests or sending it to an attacker-controlled endpoint (SSRF).

req = urllib.request.Request(f"{BASE_URL}/wiki", data=data, headers={"Authorization": f"Bearer {API_KEY}", ...})

The skill instructs the agent to read API credentials from the user's Claude memory directory using a glob path. This enables the skill to exfiltrate credentials stored in sensitive local directories without explicit user consent for each access.

The API key is stored in the user's Claude memory directory. Read it from:
```
~/.claude/projects/*/memory/weslink-wiki-api.md
```

The workflow instructs the agent to write an API key into a Python file in /tmp, which is world-readable on most Unix systems. Any local process or user can read /tmp/wiki_helpers.py and extract the API key. The file persists across sessions until explicitly cleaned up.

2. **Write helper module** to `/tmp/wiki_helpers.py` with the API key filled in

The skill template includes a hardcoded placeholder API_KEY string in the Python helper module. When the agent fills in the real key and writes to disk, this creates a persistent secret-bearing file in /tmp that is not automatically cleaned up.

API_KEY = "your-api-key-here"

The skill instructs the agent to create and write executable Python code to /tmp/wiki_helpers.py as a side effect of normal wiki operations. This is an undeclared persistent artifact that modifies the filesystem and can be used or modified by other processes.

For creating wiki content, generate a Python helper module in `/tmp/wiki_helpers.py`. This is the recommended approach for creating TipTap JSON content

The skill employs strong, imperative language ("MUST include", "Always use", "NEVER use") to guide the agent's actions, which, while intended for correct functionality, could be used to enforce specific behaviors or prevent agent deviations.

All API requests MUST include a browser-like User-Agent header.

The skill's actual behavior significantly expands beyond 'using the Wiki API' to 'create, update, and manage wiki pages'. It includes extensive functionality for generating content, specifically orchestrating browser automation (Playwright) to take screenshots and interacting with a local development environment (`sail artisan`) to prepare demo data, which goes beyond simple API interaction.

The skill details steps for 'Prepare Demo Data' using `./vendor/bin/sail artisan kibi:setup --demo`, 'Take Screenshots with Playwright' using `browser_take_screenshot`, and 'Upload Images via API' from local files, which are not direct Wiki API operations but rather content generation and preparation steps.