Security audit

WeChat Data Exporter

Security checks for vulnerabilities and agentic risk

Overview

This skill is an internal customer-data exporter that is mostly transparent about what it does, but it has under-scoped access to sensitive exports and unsafe local file handling that should be reviewed before installation.

Install only in an environment where users are authorized to export the named customers' data from the internal system. Require explicit confirmation before each export, validate client identifiers, restrict network access to the approved backend, sanitize filenames, and treat generated spreadsheets and reports as confidential customer data.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/export.py:39
Finding: Unsigned Access to Internal Customer and Private-Message Export Endpoints
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/export.py:83
Finding: User-Controlled Path Traversal in Export and Report Filenames
Content: View full analysis
str: """将二进制数据保存到文件。""" OUTPUT_DIR.mkdir(parents=True, exist_ok=True) filepath = OUTPUT_DIR / filename filepath.write_bytes(data) return str(filepath) ``` ```python elif result["type"] == "file": filename = f"{author_name}-{data_type}-{timestamp}.xlsx" filepath = save_file(result["data"], filename) ``` ```python report_path = OUTPUT_DIR / f"{author_name}-下载汇总报告-{timestamp}.json" report_path.write_text(json.dumps(results, ensure_ascii=False, indent=2), encoding='utf-8') ``` ### Technical Analysis The command-line `client_name` value is passed to `main` as `author_name` and inserted directly into spreadsheet and report filenames. No validation removes directory separators, absolute-path prefixes, drive components, or `..` traversal components. With `pathlib`, joining a base directory to an absolute second path can discard the base directory. Relative paths containing existing parent-directory components can also resolve outside `OUTPUT_DIR`. The script does not resolve the final path and verify that it remains under the intended export directory before writing. The generated timestamp and data-type suffix restrict precise filename selection, but they do not prevent placement of files outside the documented workspace. Exploitation also requires that any referenced parent directory exist and be writable by the process. ### Attack Path 1. An attacker or untrusted caller supplies a `client_name` containing path separators, traversal components, or an absolute path. 2. The script includes that input directly in the generated spreadsheet filename. 3. When an API endpoint returns a file response, `save_file` joins the unsafe filename to `OUTPUT_DIR`. 4. The resulting path r ...[truncated 1062 chars]
Remediation: View remediation
Path: base = OUTPUT_DIR.resolve() destination = (base / filename).resolve() if not destination.is_relative_to(base): raise ValueError("Output path escapes the configured directory") return destination ``` 6. Apply the same validation to spreadsheet files and the JSON report. 7. Consider using a random or server-generated export identifier rather than user input in filenames. 8. Create files with restrictive permissions when exported data may contain confidential customer or private-message information. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill declares capabilities to perform network access and file writes through its documented behavior, but it does not declare any explicit tool scope or permissions boundaries. In this context, the omission is dangerous because the skill exports client data from an internal backend system and stores it locally, increasing the risk of unauthorized access, silent exfiltration, or unintended invocation without adequate policy controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description normalizes direct backend API access to an internal system and export of specified client data, but it does not warn users that this is sensitive behavior involving internal infrastructure and potentially confidential customer information. In this context, the lack of warning makes misuse more likely and is especially concerning because the metadata claims the skill is 'verified reliable,' which could improperly lower operator caution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The invocation guidance is broad enough that the skill may be triggered automatically whenever a task involves downloading or exporting customer video-channel data. Because the skill accesses internal systems and exports sensitive client reports, overbroad routing increases the chance of unintended use, including acting on ambiguous requests or without sufficient user confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill title and user-facing strings indicate the skill is designed to operate in Chinese only, with no indication that another language can be selected. Under the policy for natural-language violations, forcing a specific language without opt-in is reportable unless the locale restriction is documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.