Security audit

Wechat Xhs Publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent WeChat/Xiaohongshu publishing workflow, but it gives an agent public posting authority while using under-scoped external services and an unsafe unpinned command template.

Review carefully before installing. Use it only for deliberate WeChat/Xiaohongshu publishing, require a final human approval before any post, pin or preinstall the Bun/tooling instead of using npx -y, and avoid running it with sensitive drafts or credentials beyond the specific account needed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:89
Finding: Unpinned Package Download and Execution via npx
Content: View full analysis
npx -y bun scripts/wechat-api.ts <文章md文件> \ --theme default \ --cover <封面图绝对路径> \ --author "<作者名称>" ``` ### Technical Analysis The publishing workflow instructs the agent to execute `npx -y bun` without specifying an exact package version, lockfile, integrity hash, or trusted local installation. If the package is unavailable locally, `npx` can retrieve it from the configured package registry and immediately execute it. The `-y` option suppresses the interactive installation confirmation. Consequently, the code executed during a future invocation is not necessarily the code that was available when this Skill was reviewed. A compromised package release, registry account, package source, or package-resolution configuration could introduce arbitrary executable behavior. The other external tools named by the Skill are not included in the audited project, so their implementations and dependency controls could not be verified. ### Attack Path 1. An attacker compromises the resolved `bun` package, its publishing account, its distribution channel, or the package registry configuration used by the environment. 2. The attacker publishes or redirects resolution to a malicious package version. 3. The agent follows the documented publishing workflow and runs `npx -y bun` without a version constraint. 4. `npx` retrieves the currently resolved package and executes it without an installation prompt. 5. The malicious package runs with the permissions and environment of the agent process. 6. It may read accessible workspace data, environment variables, authentication material, article content, or publishing credentials and may alter the content being published. ### Impact Assessment Successful exploitation permits arbitrary code execution under the op ...[truncated 506 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:89
Finding: Shell Command Injection Through Unescaped Dynamic Arguments
Content: View full analysis
npx -y bun scripts/wechat-api.ts <文章md文件> \ --theme default \ --cover <封面图绝对路径> \ --author "<作者名称>" ``` ### Technical Analysis The documented command is a shell template containing several dynamic values: - The tool directory passed to `cd` - The Markdown article path - The cover-image path - The user-provided author name The path values are not quoted. The author value is surrounded by double quotes, but the instructions do not require validation or escaping of embedded quotation marks, command substitutions, backticks, or other shell metacharacters. If an implementation constructs this command through textual substitution and passes it to a shell, attacker-controlled metadata or filenames can terminate the intended argument or introduce shell syntax. Merely surrounding a value with double quotes is insufficient when embedded quotes and command substitutions are not escaped. For example, an author value containing a closing quotation mark followed by shell syntax could escape the intended `--author` argument. Similarly, an unquoted path containing a semicolon, command substitution, whitespace, or another metacharacter could alter command parsing. Exploitation depends on the documented template being materialized as a shell command rather than invoking the process through a structured argument array. The Skill provides no validation or safe invocation requirement to prevent that unsafe implementation. ### Attack Path 1. An attacker influences an article’s author metadata, article filename, image filename, or another value substituted into the publishing command. 2. The attacker places shell metacharacters or quote-breaking content in that value. 3. The agent or implementing tool performs direct textual substitution into the documented command. 4. ...[truncated 883 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger scenarios are broad enough to match ordinary requests about news writing, article publishing, and social-media posting, which can cause the skill to activate in more situations than users expect. Because the skill then performs external publication and image/API operations, over-broad activation raises the chance of unintended data transmission or posting actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill sends article content and images to external services for image generation and publication, but it does not prominently warn users that their content will leave the local environment. In this context, users may provide unpublished drafts, sensitive material, or copyrighted assets, making undisclosed transmission a meaningful privacy and compliance risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs execution of npx -y bun without pinning a specific package version, which can fetch and run whatever version is current at execution time. In a publishing workflow that may be run repeatedly and with elevated trust, this creates supply-chain risk if the package is updated maliciously, compromised, or changes behavior unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The description and title are entirely oriented around publishing to Chinese platforms and are written only in Chinese, but the file does not explicitly document this as a China-specific or Chinese-language skill. Under the policy, locale constraints should be documented and justified or offered as an opt-in choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.