Security audit

Wechat Publisher Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do its stated WeChat draft-publishing job, but it asks for powerful account credentials and documents unsafe ways to store and display them.

Review carefully before installing on a production WeChat account. Use a dedicated low-risk account if possible, avoid CLI arguments and hardcoded AppSecret values, prefer environment or secret-manager storage, restrict permissions on the skill directory, rotate any exposed AppSecret, and clear cached tokens and local memory files when uninstalling or changing credentials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The troubleshooting guidance explicitly recommends hardcoding the WeChat AppSecret in a script and storing it in plaintext configuration, which exposes a long-lived credential to local users, backups, logs, screenshots, version control, and malware. In the context of a publishing skill for a real WeChat public account, compromise of this secret can enable unauthorized API access, content publication, and account abuse.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The installation guide includes a full AppSecret in example prompts/output, normalizing exposure of sensitive credentials in terminals, docs, screenshots, and shell history. Even if the shown value is illustrative, users may copy the pattern and reveal real secrets during setup or support interactions, increasing credential leakage risk.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The guide explicitly tells users to run a command that displays stored configuration and then shows `app_secret` in plaintext output. This encourages routine secret disclosure and suggests the tool may store or reveal credentials unmasked, which could expose the WeChat account to unauthorized API access if terminals, logs, or shared sessions are compromised.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document instructs the agent to create a WeChat draft via API and persist a DraftID/result record locally, but provides no requirement for explicit user confirmation, disclosure of external publication actions, or notice that publication metadata will be stored. In an agent setting, this can cause unauthorized external content publication and silent retention of operational metadata, which is a real security and privacy concern even if the action is only a draft creation step.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The result-recording section mandates writing publication metadata such as DraftID, title, and execution time to memory files without any warning or consent model for persistent storage. While this is lower impact than direct publication, it still creates an undisclosed audit trail that may expose sensitive workflow history or identifiers to later processes or users.

Missing User Warnings

High

Confidence: 99% confidence
Finding: This section promotes insecure secret-handling practices without any warning about credential exposure risk. Even if intended as a convenience workaround for scheduled tasks, recommending plaintext AppSecret storage materially increases the chance of credential theft and subsequent unauthorized access to the associated WeChat account.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The diagnostic script reads the config file and prints the AppSecret prefix to the console. Partial disclosure still reveals credential material and encourages operators to expose secrets in terminal output, screenshots, logs, support bundles, or shared troubleshooting transcripts.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The guide instructs users to pass the WeChat AppSecret directly as a CLI argument, which can expose the secret through shell history, process listings, terminal logging, and remote session transcripts. Because AppSecret is a sensitive credential for the公众号 API, disclosure could allow unauthorized API access, token issuance, and control over publishing-related operations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill requires users to provide highly sensitive WeChat credentials (`app_id` and especially `app_secret`) and automates publication to a third-party platform, but the documentation does not describe secure secret handling, storage practices, logging restrictions, or the privacy implications of transmitting generated content. In this context, users may paste production credentials into an untrusted skill or local environment without understanding the exposure risk, which can lead to account takeover or unauthorized posting if the secret is leaked.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Showing a plaintext AppSecret in setup examples trains users to treat secrets as normal displayable values rather than protected credentials. In the context of a publishing skill that uses privileged API credentials, this increases the chance of accidental leakage through copied terminal output, documentation, or support tickets.

Ssd 3

Medium

Confidence: 99% confidence
Finding: The configuration display example reveals the full `app_secret`, implicitly endorsing plaintext retrieval of stored credentials. Because this skill depends on privileged WeChat API credentials, exposing the secret can enable account misuse, unauthorized publishing actions, and persistence if the leaked secret is reused until rotated.

Static analysis

No suspicious patterns detected.