Security audit

Aws Wechat Article Writing

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed WeChat article-writing skill that uses a local Python helper and a user-configured LLM endpoint to generate drafts.

Install only if you are comfortable sending drafts, topic cards, writing configuration, and any selected reference documents to the LLM endpoint you configure. Use a dedicated API key, choose a trusted provider or internal proxy, and avoid passing confidential business documents through --reference unless that endpoint is approved for that data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The manifest grants shell execution to a writing/editing skill whose stated purpose is generating or rewriting article text, with no functional justification in the manifest. Shell access materially expands the attack surface because prompt-influenced behavior could trigger arbitrary command execution, file manipulation, or command chaining unrelated to article writing.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation explicitly supports sending prompts and article content to arbitrary OpenAI-compatible endpoints, including proxy or self-hosted services, but does not warn users that their content will be transmitted to external model providers. In a writing skill, inputs commonly include unpublished drafts, business materials, or internal references, so the omission can lead to unintended disclosure of sensitive content.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The file states that reference documents are injected in full into the system prompt, with no truncation, yet does not disclose the privacy consequence that entire local documents may be transmitted to the external LLM endpoint. Because this skill is designed for long-form article generation and product-reference ingestion, users may unknowingly expose proprietary or internal documentation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill requests filesystem, network, and shell permissions while presenting itself only as a writing tool, and it does not warn users that their content may be read locally, transmitted externally, or processed via command execution. This mismatch undermines informed consent and increases the risk of sensitive drafts, credentials, or local files being exposed through overprivileged operations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.