WeChat Channel Live Replay

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:38 AM UTC
• Version: 1.0.0

Overview

The skill’s main function is legitimate, but its file-writing and media-download handling are too loosely bounded for automatic installation.

Review this before installing. Use it only with a TikHub token you are comfortable granting to this skill, run it in a contained workspace, avoid path-like keyword values, and prefer a fixed output directory. The publisher should sanitize path components, enforce output containment, validate media URLs and redirects, cap download size, clean temporary audio in finally, and pin dependencies before broad use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: export.py:242

Finding

User-Controlled Path Traversal and Arbitrary File Overwrite

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: export.py:108

Finding

Unrestricted Fetch of a Server-Provided Media URL

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: export.py:284

Finding

Sensitive Temporary Audio Is Not Removed After Failures

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party Runtime Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'headers' from os.getenv (line 85, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · export.py (reported line 90)May include surrounding context.

python

'Accept': 'application/json'
    }
    try:
        response = requests.get(url=url, headers=headers, params=params, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises capabilities that imply environment access, file reads/writes, network use, and shell execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it easier for an agent runtime to invoke broader actions than a user may reasonably expect, including downloading remote content and writing files locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description emphasizes replay download and transcription features but does not clearly warn that it will fetch external video content and write transcripts, reports, and media into local directories. In an agent setting, insufficient disclosure can lead to unintended data persistence, storage of potentially sensitive content, and user surprise about side effects, especially because the skill integrates with another skill's input directory automatically.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · export.py (reported line 53)May include surrounding context.

python

sys.stderr = open(sys.stderr.fileno(), mode='w', encoding='utf-8', buffering=1, closefd=False)

WHISPER_MODEL = "base"
API_BASE = "https://api.tikhub.io/api/v1"
USER_SEARCH_URL = f"{API_BASE}/wechat_channels/fetch_user_search"
LIVE_HISTORY_URL = f"{API_BASE}/wechat_channels/fetch_live_history"

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · export.py (reported line 184)May include surrounding context.

python

print(f"  输出音频：{audio_path}", file=sys.stderr)
    cmd = ['ffmpeg', '-i', video_path, '-vn', '-acodec', 'libmp3lame', '-y', audio_path]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, encoding='utf-8', errors='replace')
        if result.returncode != 0:
            if "ffmpeg: not found" in result.stderr or "不是内部或外部命令" in result.stderr:
                raise FileNotFoundError("错误：'ffmpeg' 未在系统 PATH 中找到。请安装 ffmpeg 并将其添加到环境变量中。")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Whisper transcription call hard-codes language='zh' and uses a Chinese-only initial prompt, which forces a specific language/locale behavior. This is a natural-language policy concern because the skill does not offer user opt-in or language selection, and no region-specific justification is documented in the file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The description says the transcript is saved into the live-replay-analyzer skill's input directory, while the declared required skill at L15 is douyin-video-transcriber. This is an active documentation inconsistency about intended integration targets, which can mislead users or agents about what companion skill is actually involved.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.