Security audit
Security checks for vulnerabilities and agentic risk
This skill has a coherent WeChat article export purpose, but it needs Review because it processes remote content with overly broad network fetching, disabled browser sandboxing, and weak dependency controls.
Install only if you are comfortable running a browser-based exporter on remote WeChat articles. Prefer a sandboxed/containerized environment with restricted network egress, use --no-images unless you need local image copies, review exported files before sharing them, and pin dependencies before production use.
scripts/wechat_export.py:735Unrestricted article-controlled image fetching enables server-side request forgery
scripts/wechat_export.py:758Remote image downloads have no file-size or aggregate resource limits
scripts/wechat_export.py:174Chromium sandbox is disabled while processing remote article content
SKILL.md:109Installation instructions use unpinned third-party packages and browser artifacts
The script performs multiple outbound network operations via Playwright and requests to fetch article HTML and download remote images, but the finding indicates this capability is not declared in the skill permissions. In an agent/skill environment, undeclared network access weakens user and platform trust boundaries because the skill can contact external hosts and transfer data without explicit permission disclosure.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"--metrics-recording-only",
"--no-first-run", "--no-default-browser-check",
"--safebrowsing-disable-auto-update",
"--use-mock-keychain",
"--hide-scrollbars", "--mute-audio",
"--disable-extensions",
"--disable-features=TranslateUI",
The trigger phrase "微信导出" is broad enough to match many ordinary WeChat-related requests that may not be specifically about exporting public WeChat articles. Over-broad triggers can cause the agent to activate this skill in the wrong context, increasing the chance of unintended URL handling, file writes, or content processing without clear user intent.
The activation rule "收到 mp.weixin.qq.com 連結" is ambiguous because it allows the skill to trigger on any matching link without confirming user intent, article scope, or whether the link is actually a supported public article. This can cause unexpected processing of unrequested content and expands the skill's activation surface beyond its stated purpose.
The browser context is configured with anti-detection flags and JavaScript that masks automation indicators such as navigator.webdriver, plugins, languages, chrome objects, and permissions behavior. This goes beyond normal rendering for export and is dangerous because it deliberately circumvents anti-bot controls of the target site, enabling stealthier automated access and increasing abuse potential.
The browser context is hard-coded to use zh-CN, and related headers elsewhere also enforce Chinese language preferences. This creates a language/locale policy issue because the skill does not offer the user any choice or document this as a justified region-specific constraint.
The code creates an images directory and later writes downloaded images and markdown output to disk. Although the CLI mentions an output directory, there is no clear warning in the top-level description/docstring that the tool will persist fetched remote content and generated files locally.