Security audit

Founder-HongYun Editor Automation

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its publishing-assistant purpose, but it handles login/session credentials and can perform high-impact publishing or reminder actions without enough confirmation or transport safeguards.

Review before installing. Use only on a trusted network, prefer an HTTPS Founder platform URL, avoid exposing raw cookies or WeChat secrets in logs, use least-privileged WeChat credentials, and require a manual preview plus explicit final approval before any WeChat publication, DOI registration, or reviewer reminder send.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:5
Finding: Authenticated Platform Traffic Defaults to Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:668
Finding: Session Cookie Is Unnecessarily Extracted into Agent-Visible State
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:392
Finding: WeChat App Secret and Access Tokens Are Embedded in Command-Line URLs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:382
Finding: Untrusted Article Content Is Inserted into Shell-Based Publication Commands
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:317
Finding: Irreversible WeChat Publication Uses the First Fuzzy Search Result Without Final Confirmation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This workflow culminates in directly publishing content to a WeChat public account via external API calls, but the documented steps do not require an explicit final user confirmation after the exact article, account context, and content are resolved. Because the search is fuzzy and the first result is selected automatically, a mistaken or manipulated invocation could publish the wrong article to a public channel, creating irreversible external disclosure and reputational damage.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: This step transmits sensitive WeChat credentials and later publication data to an external third-party service using curl. External transmission is expected for the feature, but it is still security-relevant because it extends trust beyond the journal platform and can expose account capabilities or publish content if misused; the absence of an explicit confirmation and tighter handling of secrets increases the risk.
Content: Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.
4.1 获取 access_token：

bash
curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${WECHAT_APP_ID}&secret=${WECHAT_APP_SECRET}" # 返回：{"access_token":"xxx","expires_in":7200}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: This step transmits sensitive WeChat credentials and later publication data to an external third-party service using curl. External transmission is expected for the feature, but it is still security-relevant because it extends trust beyond the journal platform and can expose account capabilities or publish content if misused; the absence of an explicit confirmation and tighter handling of secrets increases the risk.
Content: Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.
4.1 获取 access_token：

bash
curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${WECHAT_APP_ID}&secret=${WECHAT_APP_SECRET}" # 返回：{"access_token":"xxx","expires_in":7200}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: Uploading a cover image to WeChat is an external data transmission to a third-party platform. In context this is intentional functionality, but it still carries risk because local or temporary files are being sent off-platform without a documented user confirmation of the exact file, and an incorrect file path or automation mistake could disclose unintended content.
Content: Scanner excerpt · SKILL.md (reported line 400)May include surrounding context.
4.2 上传封面图获取 media_id：

bash
curl -s "https://api.weixin.qq.com/cgi-bin/material/add_material?access_token=${ACCESS_TOKEN}&type=image" \ -F "media=@/tmp/cover.jpg" \ -F 'description={"title":"cover","introduction":"cover image"}' # 返回：{"media_id":"xxx","url":"xxx"}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This step sends the article body, metadata, and publication assets to WeChat's draft API, which is a substantive external disclosure of potentially unpublished content. Because the workflow auto-selects the first fuzzy search result and lacks a mandatory preview/confirmation, an incorrect match could cause unauthorized transfer and downstream publication preparation of the wrong manuscript.
Content: Scanner excerpt · SKILL.md (reported line 408)May include surrounding context.
4.3 创建草稿：

bash
curl -s "https://api.weixin.qq.com/cgi-bin/draft/add?access_token=${ACCESS_TOKEN}" \ -H "Content-Type: application/json" \ -d '{ "articles": [{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: Submitting the draft for publication is an external side effect that can make content publicly accessible through the official account. In this context the risk is elevated because this is the final irreversible publish action, yet the documented flow performs it automatically once prior steps succeed and does not require a distinct final authorization checkpoint.
Content: Scanner excerpt · SKILL.md (reported line 427)May include surrounding context.
4.4 发布文章：

bash
curl -s "https://api.weixin.qq.com/cgi-bin/freepublish/submit?access_token=${ACCESS_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"media_id":"${draft_media_id}"}' # 返回：{"errcode":0,"errmsg":"ok","publish_id":xxx,"msg_data_id":xxx}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 435)May include surrounding context.
4.5 获取文章 URL：

bash
curl -s "https://api.weixin.qq.com/cgi-bin/freepublish/get?access_token=${ACCESS_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"publish_id":${publish_id}}' # 返回：{"article_detail":{"item":[{"article_url":"http://mp.weixin.qq.com/s?..."}]}}

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: 在 L471 和 L513，文档明确写明该功能“仅展示过期稿件列表，不执行催修操作”。但 manifest 的触发关键词在 L003 直接宣称支持“自动催修”，这与正文对该能力的实际定义形成主动矛盾，容易使用户误以为会真正发送催修通知。
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: L522 和 L549 明确说明“自动催审”功能只获取并展示送专家审阶段的过期稿件，不执行催审操作；而 L003 把“自动催审”列为触发关键词，语义上表示会自动完成催审。这是文档内部关于技能意图与实际行为的直接冲突。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The '催审第 X 条' action sends reminder emails/SMS messages to reviewers, but there is no explicit execution-time confirmation before contacting external recipients. Since it acts on a cached prior list by index, a user could trigger notifications to the wrong expert or for the wrong manuscript, causing unintended communication and workflow disruption.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest explicitly supports operations involving login cookies, platform authentication, and API calls, and it also defines WeChat credentials in environment variables, but it provides no user-facing warning or consent language about handling sensitive secrets and session data. In this context, the ability to obtain login cookies and use browser-evaluated API calls increases the risk of credential leakage, session hijacking, or unauthorized account actions if outputs, logs, or prompts expose this data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest requests exec permission even though the declared capabilities and description only require browser automation and browser.evaluate. Unnecessary command-execution permission materially expands the attack surface: if the skill or a downstream prompt flow is abused, an attacker could run arbitrary local commands, access files, or pivot beyond the browser session.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file presents all setup, trigger, and safety instructions exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or an explicit region-specific justification is a reportable issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.