Security audit

Wechat Oa

Security checks across malware telemetry and agentic risk

Overview

This WeChat publishing skill does what it claims, but it can hand long-lived account secrets and draft content to a relay service and perform deletions without enough safeguards.

Install only if you trust the publisher and relay operator with your WeChat Official Account AppSecret, drafts, media, and account actions. Prefer direct mode where possible, use HTTPS-only relay endpoints if relay is required, rotate credentials after testing, protect config/cache files, and manually confirm any delete or publish-related action before letting an agent run it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The relay code explicitly includes APP_ID and APP_SECRET in a payload sent to an external relay service, extending trust to another network endpoint that now receives long-lived credentials. If the relay is compromised, misconfigured, or logs requests, an attacker can reuse the secret to impersonate the account and perform broader API actions than intended draft management.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The relay upload path sends APP_ID and APP_SECRET to an additional relay service, expanding the trust boundary beyond WeChat itself. If the relay is compromised, misconfigured, logged insecurely, or operated by an untrusted party, the credentials can be exposed and reused to access or manipulate the official account.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The relay count operation includes APP_SECRET in outbound relay parameters, unnecessarily disclosing long-lived credentials to a third-party hop. Even for read-oriented operations, credential exposure can enable broader unauthorized API access if intercepted, logged, or mishandled by the relay.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The material list relay payload embeds APP_SECRET in the JSON body sent to the relay service, again exposing sensitive credentials outside the primary integration endpoint. This creates a reusable secret-handling risk and broadens the blast radius of any relay compromise or request logging.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The delete relay path forwards APP_SECRET to a relay service for a destructive operation, combining credential exposure with the ability to delete materials. A compromised or malicious relay could use those credentials to perform unauthorized deletions or other account actions, making this more dangerous than non-destructive relay calls.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README promotes relay/hybrid modes that route WeChat API traffic through a public relay server and even provides a concrete external IP endpoint, but it does not clearly warn users that article content, media, credentials-derived API access, and operational metadata may transit a third party. In an agent context, this is more dangerous because users may enable the recommended mode without understanding that drafts and uploaded assets are being sent off-platform, creating confidentiality, integrity, and account-abuse risks.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill advertises trigger phrases such as '看看草稿箱', '查看草稿', '创建草稿', and '推送文章' directly in the description, and some are broad enough to overlap with ordinary user requests about reviewing drafts or publishing content. In an agent environment, ambiguous activation can cause the skill to engage unintentionally and perform privileged content-management actions against a connected WeChat account.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The manifest voice commands are short, natural phrases like '查看草稿箱', '推送文章到公众号', and '生成封面图', without a strong boundary indicating deliberate tool invocation. Because this skill can manage drafts, upload media, and potentially publish through official APIs or a relay service, accidental activation could lead to unauthorized or unintended account changes.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The command reference documents destructive operations such as 'delete <media_id>' and 'del-material <media_id>' alongside other commands, but does not prominently warn that these actions permanently remove drafts or materials. In a voice/agent workflow, this increases the chance that a user or model invokes deletion without understanding the consequences, causing loss of publishing assets or content.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Sending APP_SECRET through a relay path without explicit disclosure or consent is a real security weakness because it silently delegates full account trust to external infrastructure. The lack of user-facing warning increases the chance operators will unknowingly expose sensitive credentials to third-party services, logs, or support systems.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The relay functions send request bodies and an API key to a remote server over plain HTTP by default (`http://120.79.2.44`), so traffic can be intercepted or modified in transit. Because this module is a generic relay layer, callers may unknowingly transmit sensitive data without transport security or any consent/disclosure boundary, increasing the risk of credential leakage and tampering.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The upload helper reads an arbitrary local file path and transmits the file to a remote server, again using a default plain-HTTP endpoint. In an agent skill context this is more dangerous because local files may contain secrets, tokens, or user documents, and there is no built-in validation, consent prompt, or restriction on what can be exfiltrated.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The relay path sends the application's APP_ID, APP_SECRET, and a user identifier (openid) to an intermediate service via relay_post instead of talking directly to the WeChat API. This expands the trust boundary and creates a serious credential-exposure risk: compromise, logging, or misconfiguration of the relay could leak secrets and user data, enabling account takeover of the integration and unauthorized API access.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The `delete` CLI command removes drafts immediately based solely on a provided `media_id`, with no confirmation prompt, dry-run mode, or warning. In a content-management CLI, this creates a realistic risk of accidental destructive actions from user typos, pasted wrong IDs, or automation mistakes, leading to unintended content loss.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The `del_material` command deletes uploaded material immediately without any prior confirmation or cautionary messaging. Because media deletion is irreversible in many publishing workflows, a mistaken command or incorrect `media_id` can cause loss of assets and disrupt downstream publishing operations.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The code persists a WeChat access token in a predictable local cache file under a project directory without setting restrictive file permissions or using an OS-backed secret store. If the host is multi-user, the workspace is shared, or the cache directory is accidentally exposed via backups, artifacts, or source packaging, another party could recover the token and use the associated API privileges until expiry.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 89% confidence
Finding: The manifest allows any requests version >=2.31.0, which can include later vulnerable releases unless a known-safe minimum or exclusion range is specified. For an agent-facing skill that likely performs HTTP interactions, dependency flaws in requests can expose credentials, weaken transport security assumptions, or leak sensitive data depending on usage patterns.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

Category: Supply Chain
Confidence: 94% confidence
Finding: The manifest permits Pillow versions >=10.0.0 without constraining away vulnerable releases, and image-processing libraries frequently operate on attacker-controlled files. In a skill that may handle media for WeChat content, Pillow vulnerabilities can lead to denial of service, memory corruption, or in worst cases code execution when processing crafted images.

Known Vulnerable Dependency: bleach — 10 advisory(ies): GHSA-8rfp-98v4-mmr6 (Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in ); GHSA-g75f-g53v-794x (Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanni); GHSA-gj48-438w-jh9v (Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed fo) +7 more

Critical

Category: Supply Chain
Confidence: 95% confidence
Finding: Bleach is used for HTML sanitization, and the dependency spec allows potentially vulnerable versions without excluding advisory-affected releases. In a markdown/HTML publishing tool for an official account workflow, sanitizer bypasses are especially dangerous because untrusted content may be transformed and published, enabling XSS or malicious link injection in downstream rendering contexts.

Known Vulnerable Dependency: mistune — 10 advisory(ies): CVE-2026-44896 (Mistune has XSS via unescaped figclass/figwidth in Figure directive); CVE-2026-44898 (Mistune TOC Anchor Injection XSS); CVE-2026-44708 (Mistune Math Plugin has an XSS Escape Bypass) +7 more

High

Category: Supply Chain
Confidence: 92% confidence
Finding: The manifest allows mistune >=3.0.0, which may admit vulnerable parser/plugin releases if not bounded to patched versions. Because this skill appears to convert markdown into publishable content, markdown parsing flaws—especially XSS in directives, anchors, or plugins—are directly relevant and could let crafted content generate unsafe HTML.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.