WeChat Article Scraper Pro

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:43 AM UTC
• Version: 1.0.0

Overview

This skill needs review because it advertises a paid WeChat scraping service, but the implementation is mostly demo data and exposes unsafe payment and web-server controls.

Treat this as a review-required prototype, not a production-ready scraper. Do not deploy it publicly or use real payment credentials until the exposed keys are rotated, secrets move to environment-managed storage, debug mode is disabled, payment verification is server-side, task ownership is enforced, and the documentation matches the actual demo-only scraping behavior.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/app.py:26

Finding

Production Payment API Key Exposed in Source Code and Documentation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/app.py:21

Finding

Payment Controls Can Be Bypassed by Forging Flask Session Cookies

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/app.py:206

Finding

Missing Object-Level Authorization Exposes Other Users' Tasks and Articles

Content

View full analysis

') def task_status(task_id): conn = sqlite3.connect(app.config['DATABASE']) c = conn.cursor() c.execute('SELECT * FROM tasks WHERE id = ?', (task_id,)) task = c.fetchone() conn.close() if not task: return jsonify({"error": "任务不存在"}), 404 return jsonify({ "id": task[0], "official_account": task[1], "url": task[2], "status": task[3], "total_count": task[4], "completed_count": task[5], "created_at": task[6] }) ``` ```python @app.route('/articles/') def get_articles(task_id): conn = sqlite3.connect(app.config['DATABASE']) c = conn.cursor() c.execute( 'SELECT id, title, author, publish_time, read_count, like_count, url ' 'FROM articles WHERE task_id = ? ORDER BY publish_time DESC', (task_id,) ) articles = [] for row in c.fetchall(): articles.append({ "id": row[0], "title": row[1], "author": row[2], "publish_time": row[3], "read_count": row[4], "like_count": row[5], "url": row[6] }) conn.close() return jsonify({"articles": articles}) ``` ```python @app.route('/export//') def export_articles(task_id, format): conn = sqlite3.connect(app.config['DATABASE']) c = conn.cursor() c.execute( 'SELECT title, author, publish_time, content, url ' 'FROM articles WHERE task_id = ?', (task_id,) ) articles = c.fetchall() conn.close() ``` ### Technical Analysis The application retrieves task and article records using only the caller-supplied `task_id`. The database schema does not as ...[truncated 1663 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/app.py:330

Finding

Flask Development Debugger Is Exposed on All Network Interfaces

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented behavior materially differs from the observed implementation, including fake or stubbed scraping, missing export features, placeholder metadata extraction, and inconsistent billing amounts. This is dangerous because users may authorize network, storage, or payment actions based on false representations, enabling deceptive charging, hidden functionality, or trust abuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest exposes a hard-coded SkillPay API key in plaintext. Embedded secrets can be harvested by anyone with repository or package access and then abused for unauthorized payment operations, account takeover of the payment integration, fraudulent charges, or service disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A live SkillPay API key is hard-coded directly in the application source, exposing a sensitive credential to anyone with code access. If leaked or reused, attackers could abuse the billing account, impersonate the service, or incur unauthorized charges and operational impact.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill advertises real WeChat article batch scraping/export, but the implementation only fabricates article metadata and content. Because payment enforcement is active, users can be charged for a capability the code does not actually provide, making this a deceptive and potentially fraudulent mismatch rather than a harmless placeholder.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill declares network access and local file-writing behavior implicitly through its documented scraping, export, and storage features, but it does not declare any explicit tool scope or permissions. Missing scope declarations reduce transparency and reviewability, making it easier for a skill to overreach or for users to invoke it without understanding its operational access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill promotes bulk scraping, local storage, and export/downloading of third-party content and metadata without disclosing network collection behavior, retention practices, or copyright/privacy considerations. In a scraper context, this increases legal, privacy, and misuse risk because users may process content or metadata at scale without informed consent or safeguards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code explicitly sets Accept-Language to prioritize zh-CN/zh variants, which imposes a specific locale preference in outbound requests. There is no user opt-in, locale selection mechanism, or documented region-specific justification for forcing this language behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/app.py (reported line 95)May include surrounding context.

python

if TEST_MODE:
        return {"ok": True, "balance": 1000}
    try:
        resp = requests.post(f"{BILLING_URL}/charge", headers=HEADERS, json={
            "user_id": user_id, "skill_id": SKILL_ID, "amount": 0,
        }, timeout=10)
        data = resp.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill posts user_id, skill_id, and billing data to an external API, which is a network transmission of user-related data. Although exceptions are logged, there is no confirmation prompt or user-visible notice that this data is sent to a third-party billing endpoint.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/app.py (reported line 124)May include surrounding context.

python

if TEST_MODE:
        return redirect(url_for('index', test_payment='success'))
    try:
        resp = requests.post(f"{BILLING_URL}/payment-link", headers=HEADERS, json={
            "user_id": user_id, "amount": 8,
        }, timeout=10)
        payment_url = resp.json().get("payment_url")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This endpoint sends a generated user_id and payment amount to a remote billing service to create a payment link. The code lacks a user-facing disclosure or warning that interacting with the skill causes payment-related data to be transmitted externally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Comments and docstrings describe article parsing and scraping, but the code returns simulated data. This increases the risk of operator or user deception, especially in a paid tool, and can cause downstream systems to trust fabricated output as if it were collected from WeChat.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest claims Markdown and HTML export support, but the code only implements Markdown and Excel export. Users may rely on advertised export formats that do not exist, which is especially problematic in a paid service and can break automated workflows expecting HTML.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown export path writes scraped article content to disk and immediately serves the file back to the user. For code files, file-write operations should have at least some visible disclosure, but here there is no prompt, warning, print/log statement, or explanatory comment aimed at the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Excel export path persists article metadata to a local .xlsx file, which is a file-write operation affecting user/system data storage. There is no visible warning, prompt, or documentation in this file informing users that exports are saved to disk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The page explicitly states it returns simulated data and lacks real scraping logic, yet it still presents a payment flow and 'full-feature' scraping UX. In the context of a paid skill, this is a deceptive billing/trust issue that can induce users to pay for non-functional or materially misrepresented service behavior, increasing fraud and abuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This HTML/JS skill describes batch scraping of public-account articles and export to Markdown/Excel, but the user-facing text only lists features and does not disclose any potential privacy, legal, or system-impact considerations. Under SQP-2 for code files, network-backed data collection and export behavior should have some visible user disclosure when handling external content and generated datasets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document declares lang="zh-CN" and all visible user-facing text is presented only in Simplified Chinese. Under the language/locale policy, this is a natural-language constraint that should either offer user opt-in/choice or clearly document why the skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

SQP-3 applies to language or locale policy violations in natural-language content. The phrase '全中文界面' states a fixed language constraint, and the file does not offer opt-in language selection or explain that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The document declares lang="zh-CN", and all visible UI text is Chinese, which effectively fixes the interface language for all users. The file does not indicate that this is an explicitly regional tool or provide any opt-in or alternative locale, which matches the language/locale policy concern described by SQP-3.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill supports exporting scraped articles as Markdown/HTML, but this UI advertises and implements Markdown and Excel export buttons. This is a direct mismatch between the stated skill behavior and the functionality presented in code/documentation for this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.