微信公众号发布器

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:08 PM UTC
• Version: 0.1.0

Overview

This skill is purpose-aligned for WeChat publishing, but it combines account credentials, outbound publishing, and scheduled automation without clear safety controls.

Review carefully before installing. Use it only for an account where you are comfortable granting publishing API access, avoid storing AppSecret in a shared or synced plugin directory, restrict file permissions or use a secret manager/environment variable if possible, and require manual preview and confirmation before publishing or enabling any daily schedule.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30

Finding

Plaintext Storage of WeChat API Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–37
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code Snippet

json

{
  "wechat": {
    "appId": "wx...",
    "appSecret": "...",
    "thumbMediaId": "...",
    "author": "WorkBuddy"
  }
}

The documentation directs the user to place this configuration in ${CODEBUDDY_PLUGIN_ROOT}/config/user-config.json.

Technical Analysis

The skill design requires a reusable WeChat appSecret to be stored directly in a plugin-local JSON configuration file. The document does not prescribe restrictive file permissions, encryption, an operating-system credential store, environment-based secret injection, log redaction, or repository exclusion rules.

Although the repository does not contain a real credential, users following these instructions would create a plaintext credential file. Plugin directories may be exposed through source-control commits, shared archives, backups, diagnostic bundles, permissive filesystem access, or accidental logging.

The project contains only SKILL.md, so no implementation is available to verify whether runtime safeguards exist elsewhere.

Attack Path

1. A user configures the skill according to the documented procedure.
2. The user's WeChat appId and appSecret are written to config/user-config.json in plaintext.
3. An attacker obtains read access to the plugin directory through local filesystem access, a leaked backup, a shared archive, a diagnostic bundle, or an accidental source-control commit.
4. The attacker extracts the WeChat credentials from the JSON file.
5. The attacker uses the credentials to request an access token from the relevant WeChat API.
6. The attacker invokes API operations permitted for the associated account until the credential is revoked, rotated, or otherwise invalidated.

Impact Assessment

Successful exploitation may expose the WeChat account's API capabilities to an un ...[truncated 476 chars]

Remediation

View remediation

Remediation Suggestions

1. Store appSecret in an operating-system keychain, managed secret store, or equivalent protected credential service.
2. If a secret manager is unavailable, inject the credential through a protected environment variable rather than writing it to plugin configuration.
3. Keep only non-sensitive settings in user-config.json, and provide a redacted template such as user-config.example.json.
4. Add the real credential file to source-control ignore rules and packaging exclusions.
5. Create any local credential file with owner-only permissions, such as mode 0600 on supported systems.
6. Ensure logs, exceptions, command output, and diagnostic reports redact appSecret, access tokens, and authorization headers.
7. Document credential rotation and revocation procedures for suspected exposure.
8. Apply least privilege to the associated WeChat application and enable provider-supported monitoring or access restrictions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The auto-activation description is overly broad and includes common phrases such as 'AppID', 'AppSecret', and general公众号运营 terms, which can cause the skill to trigger during unrelated conversations involving credentials or publishing discussions. In this skill’s context, accidental activation is especially risky because the skill supports content generation, direct draft publishing, and scheduled automation, increasing the chance of unintended outbound actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises one-click publishing and scheduled automatic execution without an explicit user warning or mandatory confirmation before external publication. Because this is an outbound publishing integration to an official public channel, unintended activation or misunderstood workflow could result in unauthorized, premature, or reputationally damaging posts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation instructs users to store AppID and AppSecret in a local JSON config but provides no guidance on secret handling, redaction, file permission hardening, or avoiding accidental exposure in logs and prompts. In a skill that interfaces with a publishing platform, exposed credentials could allow unauthorized API access, content manipulation, or account abuse.

Content

No source excerpt is available for this finding.