wechat-tool

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:45 AM UTC
• Version: 1.0.0

Overview

This WeChat messaging skill is purpose-aligned, but it sends account tokens, recipient details, and message or file data to a third-party service over plain HTTP.

Review this before installing. Only use it if you trust the third-party service and can accept WeChat message, recipient, contact, file URL, app ID, and bearer-token data being sent to that endpoint. Prefer an HTTPS endpoint with certificate validation, store WECHAT_TOKEN only in a secrets manager, rotate any token previously used over HTTP, and keep the existing confirmation step before sends.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:3

Finding

Bearer Token and Sensitive WeChat Data Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 3
Vulnerability Type: Plaintext transmission of credentials and sensitive data
Risk Level: High

Vulnerable Code

yaml

endpoint: http://www.synodeai.com/ai

The API operations use the configured endpoint while supplying a bearer credential, for example:

yaml

- `Authorization: Bearer {{env.WECHAT_TOKEN}}`

The same authorization pattern is documented for all seven API operations.

Technical Analysis

The Skill configures its third-party API endpoint with unencrypted HTTP. Requests to this service include a reusable bearer token and may contain WeChat application identifiers, contact names, WeChat IDs, group identifiers, message contents, and file or image URLs.

HTTP provides neither transport confidentiality nor server authenticity nor message integrity. An attacker with a network position between the agent and the endpoint could inspect requests, capture the bearer token, or modify request parameters and responses. The documented user-confirmation workflow does not mitigate this issue because interception or alteration occurs after the user has approved the intended action.

Attack Path

1. A user invokes the Skill to locate a WeChat contact or group or to send content.
2. The agent sends an API request to the configured http:// endpoint with Authorization: Bearer {{env.WECHAT_TOKEN}}.
3. An attacker controlling or observing an intermediary network segment intercepts the plaintext request.
4. The attacker obtains the bearer token and sensitive request data, or alters the intended recipient or message content in transit.
5. If the server accepts the captured token, the attacker replays it to query available WeChat information or invoke message-sending operations within the token's permissions.

Impact Assessment

Successful exploitation may disclose the API bearer token, WeChat application identifier, contact and g ...[truncated 428 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the endpoint with an https:// URL and prohibit fallback or redirection to plaintext HTTP.
2. Enforce strict TLS certificate and hostname validation. Consider certificate pinning where the deployment and certificate-rotation model can support it safely.
3. Use short-lived, narrowly scoped access tokens that authorize only the operations required by the Skill.
4. Rotate or revoke any bearer token that may previously have been transmitted to this endpoint over HTTP.
5. Prevent credentials, message contents, contact identifiers, and sensitive file URLs from appearing in logs or diagnostic output.
6. Prefer expiring, access-controlled URLs for file and image delivery instead of public or long-lived links.
7. Add transport-security tests that reject non-HTTPS endpoint configuration and verify that redirects cannot downgrade the connection.
8. Preserve the existing recipient lookup and explicit user-confirmation workflow, while validating the final recipient and content immediately before transmission.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill clearly sends user messages, images, and files to an external service endpoint, but it does not warn users that their content and recipient metadata will be transmitted off-platform. This creates a privacy and consent risk, especially because the configured endpoint uses plain HTTP rather than HTTPS, increasing exposure to interception or unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill requires a bearer token and app ID but provides no warning that these are sensitive credentials or guidance on how they should be stored and handled. This can lead to unsafe deployment practices, accidental disclosure, or misuse of the token to access or send WeChat messages through the external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.