T08 · Insecure Dependencies
Error
- Location
references/deployment.md:13- Finding
Unpinned Third-Party Repository Is Downloaded and Executed Locally
- Content
View full analysis
- Remediation
View remediation
Security audit
Wewe Rss Reader
Security checks for vulnerabilities and agentic risk
Overview
The skill is aimed at reading WeChat articles, but it also handles account login, group-shares login artifacts, and starts unpinned local services, so users should review it carefully before installing.
Install only if you are comfortable running and maintaining the referenced local WeWe RSS service yourself. Pin and review the external repository before running Docker or Python code, replace the documented AUTH_CODE with a unique secret, keep ports bound to localhost, and do not send WeChat Reading login QR codes or confirmation URLs to a shared group chat.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:15- Finding
Publicly Documented Static Authentication Code
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs sending a login QR or confirmation URL to a Feishu group, which can disclose a live authentication artifact to multiple recipients beyond the intended user. Anyone who can access that group message may be able to complete or interfere with the login flow, leading to account takeover, session hijacking, or unauthorized use of the bound reading account.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Publishing a hard-coded
AUTH_CODEin skill documentation exposes a credential-like secret to anyone who can read the file and encourages insecure secret handling. If that code is accepted by the local API or related deployment, an attacker or unintended user could reuse it to gain access or automate against the service.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill’s documented scope expands from passive article reading into account authorization, subscription management, and operational control of a local service. That broader behavior increases the chance an agent will perform sensitive actions—such as logging into a third-party account or changing persistent subscriptions—without clear user intent, least-privilege boundaries, or consent checkpoints.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to run
docker compose up -dgives the agent authority to start local services based solely on an application error, which exceeds the stated reading purpose. Starting containers can execute arbitrary images, expose ports, alter host state, and revive previously configured services without the user understanding the security implications.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language instructions throughout the skill are exclusively in Chinese and frame the skill's operation in that language, without indicating that users may choose another language. This can violate language-choice policy when no opt-in or justified locale restriction is documented.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language description at L12 is written only in Chinese, which may impose a language/locale expectation without any stated user opt-in or justification. The policy specifically calls for flagging language or locale constraints when the skill does not offer a choice or document why the restriction is necessary.
- Content