T09 · Insecure Skill Coding Practices
- Location
references/config.example.yaml:163- Finding
Third-Party WeChat Reverse Proxy Configured as the Default Publishing Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
references/config.example.yaml, lines 163-166
Vulnerability Type: Untrusted credential-handling endpoint configured by default
Risk Level: HighVulnerable Code
yaml wechat_api_base: "https://wechat.aiworkskills.cn" # WeChat API base URL. Official api.weixin.qq.com enforces an # IP allowlist, which blocks calls from a laptop; this # reverse proxy avoids that. Set it to # https://api.weixin.qq.com to talk to WeChat directly.The corresponding validator accepts any nonempty endpoint without checking its protocol or host:
python def _wechat_ok(cfg: dict, env: dict[str, str]) -> bool: n = _parse_wechat_accounts(cfg.get("wechat_accounts")) if n is None: return False if not _nonempty_str(cfg.get("wechat_api_base")): return False for i in range(1, n + 1): if not _nonempty_str(env.get(f"WECHAT_{i}_APPID")): return False if not _nonempty_str(env.get(f"WECHAT_{i}_APPSECRET")): return False return TrueTechnical Analysis
The first-time setup instructions tell users to copy
references/config.example.yamlinto.aws-article/config.yaml. Consequently, the publisher-controlled domainwechat.aiworkskills.cnbecomes the effective default endpoint for downstream WeChat publishing operations instead of the officialapi.weixin.qq.comservice.The workflow requires users to configure
WECHAT_N_APPIDandWECHAT_N_APPSECRET, and it later invokes a separately installed publishing skill to obtain an access token and submit article content. Routing those operations through a third-party reverse proxy expands the credential and content trust boundary. The proxy may be able to observe authentication requests, returned access tokens, unpublished ar ...[truncated 2569 chars]- Remediation
View remediation
Remediation Suggestions
-
Change the default endpoint to the official service:
yaml wechat_api_base: "https://api.weixin.qq.com" -
Make use of any third-party proxy an explicit opt-in operation. Before enabling it, clearly disclose that authentication traffic, tokens, and article content may pass through infrastructure outside WeChat.
-
Add endpoint validation to
validate_env.py:- Require the
httpsscheme. - Accept
api.weixin.qq.comby default. - Reject unknown hosts unless the user enables an explicit override such as
allow_custom_wechat_proxy: true. - Emit a prominent warning when a non-official host is configured.
- Require the
-
Require affirmative confirmation before the agent invokes publishing through a custom endpoint. The confirmation should identify the exact hostname and the categories of data that may be transmitted.
-
Document the proxy's security controls, including secret handling, token retention, request logging, encryption, operator access, incident response, and data deletion policies.
-
Avoid forwarding long-lived AppSecrets through a proxy where possible. Prefer a design in which token acquisition occurs directly against the official API and the proxy receives only narrowly scoped, short-lived authorization material.
-
Add automated tests ensuring that insecure schemes, malformed URLs, and unapproved third-party hosts fail validation by default.
-