微信文章抓取器 - 安全版

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:52 AM UTC
• Version: 2.0.1

Overview

The skill appears to fetch WeChat articles as advertised, but it needs review because it runs a sandbox-disabled local browser on caller-supplied URLs and downloads page-selected files without adequate limits.

Install only if you are comfortable running a local browser against article URLs you trust. Avoid using it on arbitrary or attacker-provided links, prefer disabling image downloads unless needed, and run it in a restricted environment with no access to sensitive local or private-network services.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: fetch-wechat-article.js:71

Finding

Unrestricted Browser Navigation Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: fetch-wechat-article.js:9

Finding

Unvalidated Image Downloads Enable SSRF and Resource Exhaustion

Content

View full analysis

{ const client = url.startsWith('https') ? https : http; const filepath = path.join(outputDir, filename); client.get(url, (res) => { if (res.statusCode === 302 || res.statusCode === 301) { downloadImage(res.headers.location, outputDir, filename).then(resolve).catch(reject); return; } const file = fs.createWriteStream(filepath); res.pipe(file); file.on('finish', () => { file.close(); resolve(filepath); }); }).on('error', (err) => { fs.unlink(filepath, () => {}); reject(err); }); }); } ``` The page-derived image URL reaches this function through the image download loop: ```javascript for (let i = 0; i < articleData.images.length; i++) { const imgUrl = articleData.images[i]; try { const ext = path.extname(new URL(imgUrl).pathname) || '.jpg'; const filename = `image_${i + 1}${ext}`; if (saveToFile) { const imgPath = await downloadImage(imgUrl, imagesDir, filename); downloadedImages.push({ originalUrl: imgUrl, localPath: imgPath, filename }); console.log(` ✅ ${filename}`); } } catch (err) { console.log(` ❌ 下载失败：${err.message}`); } } ``` ### Technical Analysis Image URLs extracted from page-controlled HTML are requested by Node.js without validating their hosts or resolved addresses. This creates a second SSRF channel independent of top-level browser navigation. The downloader recursively follows HTTP 301 and 302 responses without validating the new destination or limiting redirect depth. It also does not account for relative `Location` headers. No request timeout, maximum response size, content-type validation, o ...[truncated 1708 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: fetch-wechat-article.js:82

Finding

Chrome Sandbox Is Disabled While Rendering Untrusted Web Content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description and all user-facing instructions are presented only in Chinese, which can constitute a language/locale policy violation when no opt-in or alternative language is offered. The README does not state that the tool is intentionally limited to Chinese-speaking users or a China-specific compliance context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The user-facing documentation is entirely in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is an intentional, justified locale restriction. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file's operational instructions, usage guidance, warnings, and examples are presented in Chinese throughout, which effectively forces a specific language for users consuming the skill documentation. The policy allows locale constraints only when documented and justified or when users are given a choice, neither of which appears here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest requests both file_write and exec capabilities, plus local browser control, but the user-facing description only presents the skill as a benign article fetcher and does not clearly disclose these privileged operations. This creates a transparency and consent problem: a user may authorize a tool that can write files and execute processes without understanding the added risk, which increases the chance of misuse or unexpected side effects if the implementation is flawed or later modified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill's natural-language comments, errors, logs, and CLI help are all presented in Chinese, and there is no option for users to select another language. This creates a locale/language policy concern because the skill imposes a single language without documenting a justified regional constraint or offering user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code defaults to saving scraped article content and downloaded images to the current directory, and later creates directories and writes multiple files. While it logs progress during execution, the CLI help and function documentation do not clearly warn users that local files and an image manifest will be created by default, which is a safety-relevant side effect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file states that the tool will automatically save output as a text file, which is a user-data-affecting behavior. The description does not include any warning or clarification about where files are written, whether existing files may be overwritten, or that local filesystem changes will occur.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The display name and description are entirely in Chinese, and the metadata does not indicate that the skill is region-specific or provide any language/locale opt-in. This can be a natural-language policy issue when users are not given a choice or justification for the locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The package description is written entirely in Chinese and presents the skill as a Chinese-language WeChat article extraction skill without indicating any user-selectable language or locale option. Under the policy criteria, this is a natural-language locale constraint that is not documented as optional or region-justified in the file.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 85% confidence

Finding

Using a caret version range for a dependency allows future compatible releases to be installed automatically, which can introduce supply-chain risk if a new upstream version is compromised or contains breaking security-relevant behavior. In this skill's context, puppeteer-core is a powerful browser automation library, so unexpected dependency changes could affect a component capable of accessing web content and local browser interactions.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json

"author": "@Adgai115",
  "license": "MIT-0",
  "dependencies": {
    "puppeteer-core": "^24.37.5"
  },
  "engines": {
    "node": ">=18.0.0"

Static analysis

No suspicious patterns detected.