Security audit

全流程微信公众号自动发文 skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for WeChat publishing, but it includes a fallback script that can post live content automatically and can upload unintended local files referenced through crafted Markdown image paths.

Install only if you are comfortable reviewing and modifying the publishing script first. Default to draft-only, add an explicit confirmation or mode check before formal publication, constrain image paths to the article directory, remove token-prefix logging, pin external dependencies, and run scheduled jobs under a least-privilege account with isolated directories and protected logs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: templates/publish.mjs:210
Finding: Workspace Path Traversal Allows Arbitrary Local File Upload
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: templates/publish.mjs:379
Finding: Fallback Publisher Bypasses Draft-Only Mode and Automatically Publishes Content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: templates/publish.mjs:176
Finding: WeChat Access-Token Material Is Exposed Through Persistent Logs
Content: View full analysis
&& /bin/bash ./run.sh >> ./output/cron.log 2>&1 0 8,17 * * * TZ=Asia/Shanghai WECHAT_AUTO_PUBLISH_MODE=draft_only /root/wechat-auto/run.sh >> /root/wechat-auto/cron.log 2>&1 0 8,17 * * * TZ=Asia/Shanghai WECHAT_AUTO_PUBLISH_MODE=full_publish /root/wechat-auto/run.sh >> /root/wechat-auto/cron.log 2>&1 ``` ### Technical Analysis The script prints the first 20 characters of the WeChat access token. Although the complete token is not printed, token fragments remain sensitive authentication material and should not be exposed in logs. The recommended cron configuration persistently records script output. Those logs may be read by other local users, backup systems, support tooling, log shippers, or monitoring services. The project does not define restrictive permissions, redaction, or retention for these files. ### Attack Path 1. The publisher authenticates using the WeChat App ID and App Secret. 2. WeChat returns an access token. 3. The script prints a 20-character token prefix. 4. Cron redirects the output into a persistent log. 5. A local user, backup process, monitoring integration, or log collector obtains the token fragment. 6. The fragment can expose authentication metadata and increases the conseque ...[truncated 557 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/environment-and-config.md:113
Finding: Mutable Upstream Repository and Unpinned Package Installation Create Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
``` 2. Verify a published checksum or cryptographic signature before installation. 3. Commit and review the package lockfile. 4. Use reproducible installation commands such as `npm ci` rather than unconstrained `npm install`. 5. Use `npm ci --ignore-scripts` where lifecycle scripts are unnecessary. 6. If lifecycle scripts are required, review and invoke them separately under restricted permissions. 7. Run installation as an unprivileged account in a container or sandbox with minimal filesystem and network access. 8. Add dependency auditing, provenance verification, and automated alerts for lockfile changes. 9. Document the exact reviewed versions instead of instructing operators to install the latest mutable upstream state. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (33)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
node templates/publish.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
node templates/publish.mjs

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
node templates/publish.mjs

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/publishing.md (reported line 23)May include surrounding context.
md
### 1. Technical success Examples: - access token retrieved - image upload succeeded - draft submission succeeded - `media_id` returned

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/publishing.md (reported line 48)May include surrounding context.
md
### 1. Technical success Examples: - access token retrieved - image upload succeeded - draft submission succeeded - `media_id` returned

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · templates/publish.mjs (reported line 355)May include surrounding context.
js
console.log('=== 微信公众号文章发布脚本 ===\n'); // 加载环境变量 const envPath = join(__dirname, '.baoyu-skills', '.env'); if (!existsSync(envPath)) { console.error(`错误: 找不到 .env 文件: ${envPath}`); process.exit(1);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
md
<project-dir>/ ├─ .baoyu-skills/ │ ├─ .env │ ├─ baoyu-image-gen/ │ │ └─ EXTEND.md │ └─ baoyu-cover-image/

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/environment-and-config.md (reported line 146)May include surrounding context.
md
<project-dir>/ ├─ .baoyu-skills/ │ ├─ .env │ ├─ baoyu-image-gen/ │ │ └─ EXTEND.md │ └─ baoyu-cover-image/

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · templates/publish.mjs (reported line 13)May include surrounding context.
js
<project-dir>/ ├─ .baoyu-skills/ │ ├─ .env │ ├─ baoyu-image-gen/ │ │ └─ EXTEND.md │ └─ baoyu-cover-image/

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · templates/publish.mjs (reported line 37)May include surrounding context.
js
<project-dir>/ ├─ .baoyu-skills/ │ ├─ .env │ ├─ baoyu-image-gen/ │ │ └─ EXTEND.md │ └─ baoyu-cover-image/

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · templates/publish.mjs (reported line 357)May include surrounding context.
js
<project-dir>/ ├─ .baoyu-skills/ │ ├─ .env │ ├─ baoyu-image-gen/ │ │ └─ EXTEND.md │ └─ baoyu-cover-image/

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · templates/publish.mjs (reported line 365)May include surrounding context.
js
<project-dir>/ ├─ .baoyu-skills/ │ ├─ .env │ ├─ baoyu-image-gen/ │ │ └─ EXTEND.md │ └─ baoyu-cover-image/

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · templates/workspace-tree.txt (reported line 3)May include surrounding context.
text
<project-dir>/ ├─ .baoyu-skills/ │ ├─ .env │ ├─ baoyu-image-gen/ │ │ └─ EXTEND.md │ └─ baoyu-cover-image/

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The description says to use the skill whenever the user wants a 'complete reproducible公众号自动发文 skill', alongside broad workflow language covering setup, drafting, publishing, and scheduling. In a manifest-scoped trigger description, this lacks clear constraints or exclusion conditions and could cause unintended activation for general WeChat publishing or content-workflow requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill supports automatic formal publication to a live WeChat account but does not present a strong, up-front warning that this can immediately post user-visible content to a production audience. In an automation context, insufficient safety gating around live publication increases the risk of accidental posting, reputational damage, and unintended distribution of incorrect or sensitive content.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This reference is primarily written in English, but several operational sections switch to Chinese, including setup guidance and proxy handling. That imposes a specific language on users without opt-in or justification, which matches the language/locale policy concern for natural-language content.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/environment-and-config.md (reported line 70)May include surrounding context.
env
WECHAT_APP_ID=fill_in_valid_value_in_target_environment WECHAT_APP_SECRET=fill_in_valid_value_in_target_environment GOOGLE_BASE_URL=https://api.ikuncode.cc/ GOOGLE_API_KEY=fill_in_valid_value_in_target_environment

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/publishing.md (reported line 14)May include surrounding context.
env
WECHAT_APP_ID=fill_in_valid_value_in_target_environment WECHAT_APP_SECRET=fill_in_valid_value_in_target_environment GOOGLE_BASE_URL=https://api.ikuncode.cc/ GOOGLE_API_KEY=fill_in_valid_value_in_target_environment

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/scheduling-and-alerting.md (reported line 69)May include surrounding context.
md
- 轮询间隔：3 秒 - 最大轮询次数：30 次（共 90 秒） - 超时处理：记录 `publish_id` 供后续手动查询，不视为发布失败 - 轮询接口：`GET https://api.weixin.qq.com/cgi-bin/freepublish/get?access_token=TOKEN`，POST body 包含 `publish_id` ## 归档格式

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This file is primarily written in English, but lines L41-L64 abruptly switch to Chinese and include locale-specific guidance for WeChat/公众号 workflows. That imposes a language/locale constraint in the documentation without stating that the skill is China-specific or offering an alternative language, which fits the natural-language policy violation criteria.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/security-boundary.md (reported line 50)May include surrounding context.
md
### 微信 AppSecret 保护 AppSecret 泄露可导致公众号被完全控制（包括群发消息、修改配置等）。建议： - `.env` 文件权限设为 `600`（仅所有者可读写）：`chmod 600 .env` - 不要将 `.env` 提交到版本控制，确保 `.gitignore` 包含 `.env` - 定期轮换 AppSecret

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file is in scope for natural-language policy checks. The instruction to draft a WeChat article body, combined with repeated Chinese-only examples and formatting conventions, constrains output to a specific language/locale without any stated opt-in or alternative, which can violate language-choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template content is entirely written in Chinese and structurally directs the author to produce a Chinese article, but it does not indicate that this locale restriction is optional or limited to a justified region-specific use case. That creates a natural-language policy concern because the skill appears to enforce a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This manifest-style file defines behavior defaults but provides no indication of when the skill should activate, what inputs it applies to, or any exclusion conditions. For manifest files, missing trigger specificity can cause unintended invocation because the activation scope is left implicit.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: templates/publish.mjs:26

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: README.md:150

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/environment-and-config.md:71

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/publishing.md:15

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: templates/env.example.txt:8