Security audit

微信公众号转个人知识库

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its WeChat-to-Obsidian note-taking purpose, but unsafe command execution and weak file/network boundaries require careful review before installation.

Install only if you are comfortable granting this skill network access, shell execution, and local file-write capability. Prefer providing an explicit vault path, avoid cookie-based fetching unless you understand the account/session risk, and do not process untrusted article links until the shell-command construction, URL validation, and vault path containment issues are fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_article.js:85
Finding: Shell Command Injection in the Curl Fallback Fetcher
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/process_article.js:68
Finding: Shell Command Injection in Child-Script Orchestration
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/fetch_article.js:38
Finding: Server-Side Request Forgery Through Weak URL Validation and Redirect Following
Content: View full analysis
{ const parsedUrl = new URL(url); const module = parsedUrl.protocol === 'https:' ? https : http; const options = { hostname: parsedUrl.hostname, path: parsedUrl.pathname + parsedUrl.search, method: 'GET', headers: { 'User-Agent': config.user_agent, 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8', 'Cache-Control': 'no-cache', }, timeout: 30000, }; ``` The shell fallback also follows redirects: ```bash HTML=$(curl -s -L \ -A "$USER_AGENT" \ -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" \ -H "Accept-Language: zh-CN,zh;q=0.9,en;q=0.8" \ --connect-timeout 15 \ --max-time 30 \ "$URL" 2>/dev/null) ``` ### Technical Analysis The JavaScript validator checks the complete URL string for a trusted-domain substring rather than validating the parsed hostname. Consequently, an unrelated URL can pass validation when the required text appears in its path, query, fragment, username, or another non-host component. The primary implementation permits both HTTP and HTTPS. The curl fallback performs no URL validation of its own and uses `-L`, which follows redirects without verifying that every redirect target remains on an approved host. This allows the process to be induced to contact loopback services, private-network hosts, link-local endpoints, or other destinations accessible from the Agent's environment. ### Attack Pat ...[truncated 1144 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/save_to_vault.py:65
Finding: Vault Directory Traversal Permits Writes Outside the Obsidian Vault
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/process_article.js:142
Finding: Indirect Prompt Injection Through Untrusted Article Content
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:12
Finding: Unpinned Global NPM Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Here the issue is not the feature mismatch itself, but that the documented behavior masks local configuration access to discover the vault path. In context, a note-saving skill may reasonably write to a user-selected vault, but silently reading application config expands host-data access beyond the minimum necessary and could reveal local environment details.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Here the issue is not the feature mismatch itself, but that the documented behavior masks local configuration access to discover the vault path. In context, a note-saving skill may reasonably write to a user-selected vault, but silently reading application config expands host-data access beyond the minimum necessary and could reveal local environment details.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Here the issue is not the feature mismatch itself, but that the documented behavior masks local configuration access to discover the vault path. In context, a note-saving skill may reasonably write to a user-selected vault, but silently reading application config expands host-data access beyond the minimum necessary and could reveal local environment details.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Here the issue is not the feature mismatch itself, but that the documented behavior masks local configuration access to discover the vault path. In context, a note-saving skill may reasonably write to a user-selected vault, but silently reading application config expands host-data access beyond the minimum necessary and could reveal local environment details.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Here the issue is not the feature mismatch itself, but that the documented behavior masks local configuration access to discover the vault path. In context, a note-saving skill may reasonably write to a user-selected vault, but silently reading application config expands host-data access beyond the minimum necessary and could reveal local environment details.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.
md
node scripts/process_article.js "https://mp.weixin.qq.com/s/xxxxx"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.
md
node scripts/process_article.js "https://mp.weixin.qq.com/s/xxxxx"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.
md
node scripts/process_article.js "https://mp.weixin.qq.com/s/xxxxx"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.
md
node scripts/process_article.js "https://mp.weixin.qq.com/s/xxxxx"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.
md
node scripts/process_article.js "https://mp.weixin.qq.com/s/xxxxx"

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The privacy section claims all data remains local and is not sent to third parties, but the workflow explicitly retrieves content from remote WeChat URLs and even suggests using curl with cookies. This is a material privacy misrepresentation: users may provide authenticated cookies or sensitive links under false assumptions, enabling unintended disclosure to remote services and weakening informed consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs reading a local Obsidian configuration file under the user's home directory to discover vault paths. That is broader host-data access than necessary for article conversion and can reveal sensitive filesystem structure, workspace names, and other personal metadata, especially if done automatically without explicit consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTTP request hard-codes an Accept-Language header of "zh-CN,zh;q=0.9,en;q=0.8", which imposes a locale preference regardless of user settings. The file does not provide any opt-in, configuration, or justification that this skill must operate only in a Chinese locale.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes a skill for fetching WeChat article content and converting it into notes. While network access is expected, invoking a shell-accessing subprocess via execSync introduces command execution capability that is not necessary to the stated purpose and expands operational risk beyond simple HTTP retrieval.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The curl fallback explicitly sends "Accept-Language: zh-CN,zh;q=0.9", again enforcing a specific locale in natural-language-facing behavior. No user choice or documented regional limitation is present in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The module docstring and usage examples describe the skill exclusively in Chinese and state that it generates Chinese-structured Obsidian notes. The file does not provide any opt-in, language-selection parameter, or justification that this skill is intended only for a Chinese-specific environment, which can violate a language/locale choice policy.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script includes logic to read the local Obsidian configuration and enumerate vault paths, which reveals local filesystem information unrelated to the file's actual current behavior. Even if not exercised here, this is privacy-sensitive capability that expands access to user environment metadata without a clearly necessary purpose at this stage.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's advertised behavior says it will generate and store structured local notes, but the implemented behavior stops after fetching the article and printing the full content to stdout for an external agent to process. This creates a trust-boundary mismatch: users may believe processing is local when the data is actually exposed to another component, increasing risk of unintended disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script prints the full article body and metadata to stdout for an external agent to consume, but does not clearly warn the user that content will leave the script's local processing boundary. If the article contains sensitive or copyrighted material, this can cause unintended disclosure to downstream tooling, logs, or remote services.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This Python file contains natural-language docstrings and CLI help text entirely in Chinese, and the script description gives no option for users to select another language or indication that the tool is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The config sets "language": "zh", which hard-codes a specific language/locale preference. Under the policy, forcing a language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code makes an external curl request to a user-supplied URL, which is a network operation covered by the missing-warning rule for code files. While the script prints that it is fetching the URL, it does not disclose any privacy or network implications beyond progress output, and there is no accompanying docstring/comment warning about the outbound request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's description, options, errors, and progress messages are all hard-coded in Chinese. This forces a specific language for all users without offering a locale choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Reading the user's Obsidian configuration without an explicit warning or consent at the access point is a privacy issue because it discloses local application state and filesystem paths. In this skill context, that access is especially questionable because the script does not complete the promised local save flow in this file.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest says the skill converts WeChat articles into notes and stores them locally, which justifies writing notes into a vault. However, this implementation also inspects a user-specific application config file under '~/Library/Application Support/obsidian/obsidian.json' to enumerate/open vault metadata, which is an additional local data access capability not explicitly implied by article conversion itself.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/fetch_article.js:86

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/process_article.js:58