Security audit

WeChat Article Collector

Security checks for vulnerabilities and agentic risk

Overview

This skill is presented as a WeChat article backup tool but actually supports broad authenticated website scraping and has a command-injection flaw in its URL handling.

Review carefully before installing. Use only with accounts and websites you are authorized to archive, avoid custom or login-required targets, do not schedule unattended runs until retention and storage are clear, and fix the `shell=True` URL handling plus filename sanitization before running it on untrusted input.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/collect_articles.py:83
Finding: OS Command Injection Through the User-Controlled URL
Content: View full analysis
' | browser-harness ``` A URL containing a single quote can terminate the `printf` argument. Shell metacharacters can then append an arbitrary operating-system command. Quoting the URL inside the generated Browser Harness script does not protect the surrounding shell command. This is distinct from the safer `_run_browser_script()` implementation in `scripts/utils.py`, which invokes Browser Harness using an argument array and passes the script through standard input without a shell. ### Attack Path 1. An attacker supplies a crafted value for `--url`, or convinces a user or automation workflow to execute the collector with that value. 2. `args.url` is assigned to `profile["list_url"]`. 3. The value is interpolated into `navigate_code`. 4. The generated code is placed inside a single-quoted `printf` shell command. 5. A single quote in the attacker-controlled value terminates the quoted shell argument. 6. The attacker's appended shell command is interpreted because `shell=True` is enabled. 7. The command executes with the operating-system privileges of the user running th ...[truncated 670 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/utils.py:153
Finding: Path Traversal Through an Untrusted Article Date
Content: View full analysis
:"/\\|?*]', '', title) if date: filename = f"{date}_{safe_title}.md" else: filename = f"{safe_title}.md" filepath = save_dir / filename ``` The resulting path is later opened for writing: ```python if content and len(content) > 200 and "Traceback" not in content: with open(filepath, "w", encoding="utf-8") as f: f.write(f"# {title}\n\n") if date: f.write(f"**发布日期**: {date}\n\n") f.write(f"**原文链接**: {link}\n\n") f.write("---\n\n") f.write(content) return True ``` ### Technical Analysis Article dates are extracted from remote page content and are therefore untrusted. Although the title is partially sanitized, the `date` value is inserted into the filename without removing path separators or traversal sequences. If a malicious page exposes a date value containing components such as `../`, `Path` joins those components with `save_dir` without enforcing containment. The subsequent `open(filepath, "w")` operation follows the resulting path and can create or truncate a file outside the intended article directory. The `.md` suffix limits the final extension but does not prevent traversal or overwrite of existing Markdown files. The code also does not resolve the destination and verify that it remains beneath `save_dir`. ### Attack Path 1. A user runs the collector against an attacker-controlled or compromised page. 2. The page places a traversal sequence in the element selected as the article date. 3. `extract_articles_generic()` records that date in the article metadata. 4. `download_article_content_generic()` concatenates the unvalidated date with the sanitized title. 5. `s ...[truncated 846 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:27
Finding: Unpinned Browser Harness Dependency Installed From a Mutable Branch
Content: View full analysis
Remediation: View remediation
uv tool install -e . ``` Further hardening should include: 1. Publish the expected commit hash and dependency version in the documentation. 2. Verify signed tags or release signatures where available. 3. Verify downloadable artifacts using a documented cryptographic checksum. 4. Avoid editable installation for production use where a reproducible packaged release is available. 5. Periodically review and deliberately update the pinned version. 6. Document the permissions and browser access granted to Browser Harness before users run its setup command. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (33)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documentation frames the skill as a WeChat article backup tool, but later sections describe adapting it to scrape other sites, perform batch interactions, fill forms, manage accounts, and export business/customer data. That mismatch is risky because it hides that the same automation pattern could be repurposed for broad authenticated scraping or account actions beyond the declared use case.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documentation frames the skill as a WeChat article backup tool, but later sections describe adapting it to scrape other sites, perform batch interactions, fill forms, manage accounts, and export business/customer data. That mismatch is risky because it hides that the same automation pattern could be repurposed for broad authenticated scraping or account actions beyond the declared use case.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This is a true parameter-abuse issue because tool input flows into a shell-executed command string that controls browser-harness behavior. Given the skill's generic URL override and authenticated-browser context, an attacker or malicious task input could leverage this to run arbitrary shell commands locally or drive the browser harness to exfiltrate data from unintended sites.
Content: Scanner excerpt · scripts/collect_articles.py (reported line 89)May include surrounding context.
python
time.sleep({profile["wait_after_load"]}) print("OK") ''' result = subprocess.run( f"printf '{navigate_code}' | browser-harness", shell=True, capture_output=True,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The publishing documentation describes automated collection, deduplication, full-text download, local storage, and even scheduled execution, but it does not prominently warn users that account content will be bulk-exported and persisted on disk. In the context of a browser-connected tool operating against a logged-in WeChat official account backend, that omission increases the risk of users unintentionally extracting and retaining sensitive or regulated content without understanding the data-handling consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file explains that the skill will automatically collect full WeChat public-account articles and save them locally, which affects user data handling and potentially content privacy. Under the markdown criteria for SQP-2, the description should disclose that article content and account-associated data will be copied to local storage.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs users to run local Python scripts, read and write files under the user's home directory, and invoke shell commands, but it declares no explicit tool scope or permission boundaries. This is dangerous because a reviewer or agent cannot easily determine what filesystem and command execution access the skill expects, increasing the chance of over-privileged execution and misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill requires access to a browser session already logged into the WeChat public account backend, but it does not clearly warn that browser automation will operate with the full privileges of that authenticated session. This is dangerous because it normalizes automated access to a sensitive account context without adequately disclosing privacy, account integrity, or session abuse risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill describes downloading and locally storing full article contents and later recommends unattended cron execution, but it does not prominently warn users about persistent local data creation, storage location, retention, or unattended operation risks. This can lead to silent accumulation of sensitive or copyrighted content and automated background execution without informed consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The advanced sections explicitly promote extending the skill into broad social scraping, batch actions, account management, monitoring, and export of financial or customer data. In the context of browser automation against logged-in sessions, this materially increases abuse potential by encouraging repurposing for high-sensitivity authenticated actions and data extraction.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation broadens the skill from a WeChat-specific backup utility into a generic scraper for arbitrary websites, which materially expands the operational scope beyond the stated manifest purpose. In an agent/browser-harness context, this increases the chance of collecting data from unintended domains, including private or licensed content, and weakens user expectations about where authenticated session data may be used.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guide explicitly instructs users to scrape any login-required website by reusing an existing authenticated browser session. This is dangerous because it encourages access and bulk extraction under the user's credentials on arbitrary sites, which can expose private account data, defeat user intent boundaries, and enable collection from services far outside the skill's declared purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The usage instructions normalize scraping logged-in sites via an existing browser session without warning that the session may grant access to sensitive personal, business, or subscription-only content. In the context of Browser Harness, this omission is significant because the tool can act with the full privileges of the logged-in user and persist extracted data locally, creating privacy, compliance, and credential-bound data exposure risks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest frames the skill as a tool for collecting articles from the WeChat public-account backend via a logged-in Browser Harness session. However, this configuration also supports Zhihu columns, Juejin posts, and a fully custom website profile, which materially broadens the skill beyond the stated WeChat-only scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The custom profile is effectively unconstrained: it allows arbitrary list URLs and selectors with no domain restrictions or safety guardrails. In a skill that connects to a logged-in browser session, this can enable navigation to unintended sites and scraping of sensitive authenticated content from arbitrary domains, especially if downstream code populates these fields dynamically or from user-controlled input.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says this skill is for collecting articles from a user’s logged-in WeChat public-platform backend, but the file-level docstring labels it as a generic webpage article collector supporting multiple website configurations. The CLI also exposes profiles such as zhihu_column, juejin, and custom, indicating broader behavior than the manifest claims.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file's natural-language strings, including the module docstring and argument descriptions, are entirely in Chinese, which effectively imposes a specific language on users. There is no indication that the skill is region-specific or that users can opt into another language, which fits the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code is presented as a WeChat backend article backup tool but implements a general website collector with overridable URL and selector inputs. In the context of a browser automation skill attached to a user's logged-in session, unjustified breadth materially increases the chance of overcollection and abuse beyond the user's expected authorization boundary.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The argument parser description says '通用网页文章采集器' and the profile help lists multiple non-WeChat targets. This directly conflicts with the stated skill intent in the manifest, which frames the tool as specifically operating against a logged-in WeChat public-platform backend.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Supporting arbitrary URLs and custom selectors expands the skill far beyond the stated WeChat-backup use case, enabling collection from any site reachable in the logged-in browser context. In a tool that relies on an already-authenticated browser harness, this broader scope increases the risk of misuse for unauthorized scraping or access to unrelated authenticated content.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 98% confidence
Finding: The code builds a shell command with f-string interpolation and executes it with shell=True, embedding untrusted values from profile["list_url"] and profile["wait_after_load"] into navigate_code. Because --url can be user-supplied and the payload is wrapped through printf into browser-harness, a crafted value containing quotes or code can break out and inject arbitrary shell commands or unintended browser-harness instructions.
Content: Scanner excerpt · scripts/collect_articles.py (reported line 89)May include surrounding context.
python
time.sleep({profile["wait_after_load"]}) print("OK") ''' result = subprocess.run( f"printf '{navigate_code}' | browser-harness", shell=True, capture_output=True,

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's natural-language interface, including status messages and usage guidance, is entirely in Chinese. This forces a specific language for all users without opt-in or justification, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/test_install.py (reported line 14)May include surrounding context.
python
"""测试 Browser Harness 是否可用""" print("测试 1: Browser Harness 可用性...") try: result = subprocess.run( ["browser-harness", "--doctor"], capture_output=True, text=True,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/utils.py (reported line 23)May include surrounding context.
python
"""测试 Browser Harness 是否可用""" print("测试 1: Browser Harness 可用性...") try: result = subprocess.run( ["browser-harness", "--doctor"], capture_output=True, text=True,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 85% confidence
Finding: The code executes the external browser-harness tool with dynamically generated script content derived from profile fields and article links. Although shell=True is avoided, this still creates a code/script-injection boundary into a privileged browser automation context tied to a logged-in WeChat backend, so attacker-controlled selectors or links could trigger unintended browser actions or data access.
Content: Scanner excerpt · scripts/utils.py (reported line 47)May include surrounding context.
python
try: with open(tmp_path, "r") as f: result = subprocess.run( ["browser-harness"], stdin=f, capture_output=True,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The helper executes the external browser-harness program, which is a subprocess operation covered by the warning requirement for code files. The function includes an internal docstring but no visible confirmation, print/log message, or other user disclosure that an external tool will be invoked.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.