Security audit

整理当天AI行业新闻发布到公众号

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it needs review because it can install an unpinned global tool, use WeChat account credentials, fetch arbitrary article URLs, and publish or modify user-supplied Markdown files.

Install only if you are comfortable letting this skill use WeChat official-account credentials and create drafts. Preinstall or pin @wenyan-md/cli yourself, keep WeChat secrets out of shared documentation files, review every generated draft before publication, avoid stealth scraping unless authorized, and do not pass private local Markdown files or non-news URLs to its scripts.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to perform shell execution, outbound network access, and local file writes, yet no permissions are explicitly declared. That creates a capability-transparency failure: users or orchestrators may invoke the skill without understanding it can fetch remote content, publish externally, and modify local state such as memory files. In this context, the combination of shell + network + file write materially increases risk because it can lead to unintended remote actions and persistence of data.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is narrowly framed as fetching AI news and publishing a generated article, but the behavior described by analysis expands to arbitrary local Markdown publication, arbitrary URL scraping, and credential/tool handling beyond that scope. Scope expansion is dangerous because it enables the skill to be repurposed for unrelated content publication or broader data access than users expect, undermining trust and consent boundaries. In a publishing skill, the ability to publish arbitrary local files is especially sensitive because it can leak local content to an external platform.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script installs a global npm package at runtime with elevated trust in the public package registry, creating a supply-chain risk and changing the host environment as a side effect of normal publishing. In a skill execution context, this is dangerous because package installation can execute install scripts and pull unpinned code from the network without prior review.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script reads WeChat credentials from a general workspace TOOLS.md file rather than a narrowly scoped secret store, which broadens access to sensitive data beyond the immediate task. In an agent skill ecosystem, harvesting secrets from shared documentation-like files is especially risky because it normalizes secret discovery across the workspace and may expose unrelated credentials.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script pulls WECHAT_APP_ID and WECHAT_APP_SECRET from a general-purpose TOOLS.md file by grepping and exporting values, which expands trust to an unrelated shared document and creates a secret-handling boundary problem. If TOOLS.md is modified, poisoned, or broadly readable, the script may consume attacker-controlled credentials or expose sensitive secrets through unsafe storage practices.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Automatically running 'npm install -g @wenyan-md/cli' at execution time introduces an unpinned supply-chain dependency with code execution on the host. This means a normal publish action can unexpectedly download and execute external package install scripts, which is risky in an agent skill because it broadens behavior from publishing content to arbitrary software installation.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The --content argument passes a user-supplied URL directly into scrape_article_content(), which then fetches that URL without validating that it belongs to the intended 36kr or huxiu domains. In an agent skill context, this creates an SSRF-style primitive that could be abused to make the host contact arbitrary external or internal endpoints, expanding the skill beyond its stated purpose of scraping only approved news sources.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger phrases are broad enough to match ordinary content-creation requests, increasing the chance the skill activates when the user did not intend news scraping and WeChat publication. Mis-triggering is risky here because the skill performs external network access and prepares remote publication, so accidental activation can cause unintended outbound actions or draft creation. The operational context makes this more dangerous than a harmless read-only skill.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill description does not clearly warn that it will access external websites and publish content to a remote WeChat draft box. Lack of upfront disclosure weakens informed consent and can surprise users with outbound data flows or account actions, particularly when credentials and whitelisted IP requirements are involved. In a skill that can publish remotely, hidden side effects are a meaningful security concern.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script modifies the user-supplied markdown file in place by inserting a cover field without warning, which can cause unintended content changes or corrupt files in automated workflows. While not a direct code-execution issue, silent mutation of inputs is dangerous in publishing pipelines because it undermines user control and auditability.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script handles sensitive credentials by scraping them from a shared markdown file and exporting them into the shell environment without a clear warning about secret handling, storage expectations, or access controls. This increases the chance of accidental exposure through shared files, shell history, logs, subprocess inheritance, or misuse by other tools in the same session.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script edits the user-supplied markdown file in place with sed to insert a cover field, without confirmation or creating a copy. This can silently alter source content, break formatting, or corrupt files in automation workflows where the input file is expected to remain unchanged.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script accesses sensitive WeChat secrets from a broadly shared documentation-style file and exports them into the shell environment without a strong warning, consent step, or safer secret-handling pattern. This increases the chance of accidental disclosure through shell inheritance, debugging, logging, or reuse by unrelated commands in the same session.

Static analysis

No suspicious patterns detected.