Grades are a hygiene check, not a security guarantee.

Claude Code, Skill

Awesome Weread

精选「微信读书」官方 Agent Skill，以及一切基于它的二创项目。

Compatibility: Not stated.

Grade B

Minor issues only, no Medium or High. Worth a quick look at the findings below before installing.

Graded by PlugVetRubric v2

Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.

Rescanned at commit 18c474ce67e7.

NETWORK_NO_FIXED_HOST SECRETS_PATH_DOTENV SECRETS_ENV_READ

Why this grade

  • NETWORK_NO_FIXED_HOST Low

    Makes a network call whose host is not written as a fixed address.

    docs/promo/runs/2026-05-28/marcus776957-weread-master/artifacts/gateway-smoke-test.py, line 31 with urllib.request.urlopen(req, timeout=30) as resp:

  • SECRETS_PATH_DOTENV Low

    Mentions a .env file.

    docs/promo/runs/2026-05-21/viewer12-weread-mirror/summary.md, line 35 这个项目的目标产物是单文件 HTML 私人阅读画像。用户已明确授权提交阅读相关产物，因此这次按 weread-mirror 的方法论补了一份可公开查看的镜像画像页面，并提交截图。产物包含真实阅读统计、真实书名和基于数据的画像观察，但不包含 AK、Authorization header 或 `.env`。

  • SECRETS_ENV_READ Note

    Reads an environment variable whose name contains KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL.

    docs/promo/runs/2026-05-28/marcus776957-weread-master/artifacts/gateway-smoke-test.py, line 13 api_key = os.environ.get("WEREAD_API_KEY", "")

Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.

Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.

What was checked

Plain notes from the hygiene checks.

  • Permissions

    Pass

    No shell or command execution found, and no extra permission was declared.

  • Install and update

    Pass

    No install-time script found, and dependencies are pinned or absent.

  • Network

    Concern

    can reach a host that is not written as a fixed address.

    NETWORK_NO_FIXED_HOST

    docs/promo/runs/2026-05-28/marcus776957-weread-master/artifacts/gateway-smoke-test.py, line 31

    with urllib.request.urlopen(req, timeout=30) as resp:

    scripts/discover.mjs, line 99

    const res = await fetch(info.download_url);

    scripts/network-preflight.sh, line 67

    if command -v curl >/dev/null 2>&1; then

    Show more

    scripts/network-preflight.sh, line 68

    without_proxy curl -fsSIL --max-time "$TIMEOUT" --noproxy '*' "$GITHUB_URL" >/dev/null 2>&1

    docs/promo/runs/2026-05-25/zzylanmengqingchuan-weread-tools/artifacts/reading-persona-source.html, line 932

    response = await fetch(API_URL, {

    docs/promo/runs/2026-05-25/zzylanmengqingchuan-weread-tools/artifacts/weread-report-source.html, line 286

    const res = await fetch(API_BASE, {

    docs/promo/runs/2026-05-26/alexsowake-weread_personality_summery/artifacts/index.html, line 927

    const res = await fetch(`${API_BASE}/api/check`, {

    docs/promo/runs/2026-05-26/alexsowake-weread_personality_summery/artifacts/index.html, line 1019

    const res = await fetch(`${API_BASE}/api/stage01`, {

  • Secrets

    Concern

    reads a credential or environment file.

    SECRETS_ENV_READ SECRETS_PATH_DOTENV

    docs/promo/runs/2026-05-28/marcus776957-weread-master/artifacts/gateway-smoke-test.py, line 13

    api_key = os.environ.get("WEREAD_API_KEY", "")

    scripts/discover.mjs, line 169

    if (!process.env.GOOGLE_API_KEY) {

    docs/promo/runs/2026-05-21/viewer12-weread-mirror/summary.md, line 35

    这个项目的目标产物是单文件 HTML 私人阅读画像。用户已明确授权提交阅读相关产物，因此这次按 weread-mirror 的方法论补了一份可公开查看的镜像画像页面，并提交截图。产物包含真实阅读统计、真实书名和基于数据的画像观察，但不包含 AK、Authorization header 或 `.env`。

    Show more

    scripts/discover.mjs, line 173

    const ai = new GoogleGenAI({ apiKey: process.env.GOOGLE_API_KEY });

    docs/promo/runs/2026-05-24/kejixiaoliang-read-persona/summary.md, line 31

    用户已明确授权提交阅读相关产物，因此这次把真实阅读画像 HTML 与截图都放进了 `artifacts/`。仍然没有提交微信读书 AK、Authorization header 或 `.env`。

    docs/promo/runs/2026-05-25/AstrophelXD-WeReadAura/summary.md, line 21

    微信读书 AK 只通过服务端环境变量传入。没有写入 `.env.local`，也没有提交 AK。

    docs/promo/runs/2026-05-25/ZiGmaX809-Weread_ReadTime_Heatmap/summary.md, line 35

    本次提交的是日期级阅读时长、SVG 和截图，不包含微信读书 AK、Authorization header、`.env` 或原始划线文本。

    docs/promo/runs/2026-05-25/rayford295-rayford-knowledge-atlas/summary.md, line 36

    用户已明确授权提交阅读相关产物，因此这次把真实阅读 metadata 和 reading intelligence JSON 一并放进 `artifacts/data/`。仍然没有提交微信读书 AK、Authorization header 或 `.env`。

    docs/promo/runs/2026-05-26/Ceelog-OpenWeRead/summary.md, line 50

    - “密钥只走环境变量”：不写 `.env`，不把 key 打进日志

    docs/promo/runs/2026-05-26/alexsowake-weread_personality_summery/artifacts/readme-signals.txt, line 1

    ./test.ts:3:// Add WEREAD_API_KEY=<YOUR_WEREAD_API_KEY> key> to .env, then:

  • Agent instructions

    Pass

    No instruction to ignore earlier instructions or to hide a step.

  • Obfuscation

    Pass

    No encoded or minified payload found.

  • Licence

    Pass

    A licence file is present (LICENSE).

  • Maintainer activity

    Pass

    The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 18c474ce67e7. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked:

View source

github.com

Commit graded: 18c474ce67e75ce50490e89cbf3100b13784a4e5

This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.

Read how this letter is chosen