wechat draft deleter

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:22 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform its stated WeChat draft-deletion task, but it needs review because it includes real-looking credentials and risky installer/dependency behavior around a destructive account operation.

Review before installing. Replace the example credentials with placeholders and rotate them if they might be real, avoid running the installer with elevated privileges, prefer a virtual environment with pinned Python dependencies, and only run deletion commands against Media IDs you have backed up or are certain should be removed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:112

Finding

Potential WeChat Application Credentials Exposed in Documentation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: install.sh:14

Finding

Unpinned and Non-Reproducible Python Dependency Installation

Content

View full analysis

=2.25.1 ``` ### Technical Analysis The installer retrieves the latest version of `requests` accepted by the package index at installation time. It does not pin an audited version, validate hashes, use a lock file, or install from the project's declared requirements file. The lower-bound-only requirement in `requirements.txt` also allows any future release. Consequently, two installations of the same Skill version can install different code. The `--quiet` option further reduces visibility into the package source and dependency-resolution process. No malicious dependency is present in the audited package itself, and `requests` is a legitimate package. The vulnerability is the mutable, insufficiently verified supply-chain process: a compromised package-index account, index, resolver configuration, or future incompatible release could introduce unexpected code during installation. ### Attack Path 1. A user executes `install.sh`. 2. `pip3` resolves `requests` and its transitive dependencies using the user's configured package index. 3. The installer accepts mutable future versions and performs no integrity verification. 4. If an accepted release or configured package source is compromised, malicious or altered package code is installed. 5. That code executes in the Python environment and with the privileges under which installation or the Skill occurs. 6. Because this Skill handles WeChat credentials and tokens, compromised dependency code could read or transmit those values. ### Impact Assessment The potential privilege level is the privilege of the user running `pip3` and the resulting Python program. If installation is performed with elevated privileges, the aff ...[truncated 434 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package.json:12

Finding

Unnecessary npm Package with the Same Name as a Python Dependency

Content

View full analysis

=2.25.1" } ``` ### Technical Analysis The Skill implementation is written in Python and imports the Python package named `requests`. However, `package.json` declares an npm package also named `requests`. npm and Python Package Index packages are unrelated even when they share a name. The Node.js dependency is not required by the reviewed implementation. Package-management tooling or a user running `npm install` may therefore retrieve unrelated code from the npm ecosystem. This unnecessarily expands the supply-chain attack surface and may expose the user to npm lifecycle scripts or vulnerabilities in a component that the Skill does not need. Static review did not establish that the npm package is malicious. The confirmed flaw is the incorrect dependency ecosystem and the resulting installation of unrelated code. ### Attack Path 1. A user, automated build service, or package scanner observes `package.json` and runs `npm install`. 2. npm resolves the package named `requests` from the configured npm registry. 3. Code unrelated to Python's `requests` library is downloaded. 4. Any permitted package lifecycle behavior executes with the privileges of the npm process. 5. A compromised or malicious npm package could access workspace files, environment variables, or network resources even though Node.js is not needed for the declared Skill functionality. ### Impact Assessment The dependency exceeds the minimum privileges and components required for draft deletion. If abused through a compromised package or lifecycle script, the impact could include arbitrary code execution with the invoking user's privileges, access to repository files, and exposure of environment variables containing WeChat credenti ...[truncated 171 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: install.sh:21

Finding

System-Wide Mutable Command Link Exceeds Least-Privilege Requirements

Content

View full analysis

/dev/null || true ``` ### Technical Analysis The installer attempts to create or replace a command in `/usr/local/bin`, a system-wide executable namespace that normally requires elevated privileges. A global command is not necessary for the declared draft-deletion functionality; a user-local executable directory is sufficient. The symbolic link points directly to the script in the current project directory rather than to an immutable or package-managed installed copy. If that project file is later modified, replaced, or made writable by another party, invoking the apparently trusted global command executes the changed content. The `-f` option permits replacement of an existing path, while `2>/dev/null || true` suppresses all errors and reports successful installation even when the link was not created. This conceals permission failures and partial installation state. ### Attack Path 1. The installer is run with sufficient permissions to write to `/usr/local/bin`. 2. It creates or replaces `/usr/local/bin/wechat-draft-delete` with a link to the project script. 3. The project directory remains mutable after installation. 4. An attacker or compromised update process modifies `scripts/delete_drafts.py`. 5. A user later invokes `wechat-draft-delete`, believing it to be the reviewed utility. 6. The shell follows the global symbolic link and executes the modified script with the invoking user's privileges and access to WeChat environment credentials. A second failure mode occurs if a pre-existing command with the same name is overwritten through `ln -sf`. ### Impact Assessment The installation modifies a system-wide command namespace and can replace an existing p ...[truncated 433 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The primary description is written entirely in Chinese and presents the skill as intended for Chinese-language use, without indicating any user choice of language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

md

## API文档

### 微信公众号API
- **接口**: `POST https://api.weixin.qq.com/cgi-bin/draft/delete`
- **参数**: `{"media_id": "草稿Media ID"}`
- **响应**: `{"errcode": 0, "errmsg": "ok"}`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

## API文档

### 微信公众号API
- **接口**: `POST https://api.weixin.qq.com/cgi-bin/draft/delete`
- **参数**: `{"media_id": "草稿Media ID"}`
- **响应**: `{"errcode": 0, "errmsg": "ok"}`

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README contains a concrete AppID and AppSecret in an example shell script, which teaches users to handle secrets unsafely and may expose a real credential if it was copied from an actual account. In a deletion-focused skill, leaked WeChat API credentials are especially dangerous because they can be used to authenticate to the official API and perform unauthorized operations, including destructive draft deletions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documentation describes capabilities that require environment variable access, file reading, network calls, and shell-based installation, but it does not declare any explicit tool scope or permissions. This creates an under-specified trust boundary where an agent may invoke broader capabilities than a user expects, increasing the risk of unintended secret access or destructive operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The installer forcibly creates or overwrites a symlink in /usr/local/bin using ln -sf and suppresses errors, without prompting the user or verifying that the destination is safe to replace. This can unexpectedly clobber an existing command of the same name or create a privileged system-wide change the user did not explicitly approve, which is risky in an installer context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The script sends the App Secret in the URL query string when requesting an access token. Secrets embedded in URLs can be exposed via logs, shell history, proxy logs, monitoring systems, or error messages, increasing the chance of credential leakage.

Content

Scanner excerpt · scripts/delete_drafts.py (reported line 15)May include surrounding context.

python

def get_access_token(appid: str, secret: str) -> str:
    """获取微信公众号access_token"""
    url = f"https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={appid}&secret={secret}"
    response = requests.get(url)
    data = response.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The script places the access_token in the request URL query string for the delete operation. Access tokens in URLs may be captured by application logs, reverse proxies, debugging output, or observability tooling, which can allow unauthorized API actions if the token is reused before expiry.

Content

Scanner excerpt · scripts/delete_drafts.py (reported line 27)May include surrounding context.

python

def delete_draft(access_token: str, media_id: str) -> bool:
    """删除单个草稿"""
    url = f"https://api.weixin.qq.com/cgi-bin/draft/delete?access_token={access_token}"
    data = {
        "media_id": media_id
    }

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/delete_drafts.py (reported line 33)May include surrounding context.

python

}
    
    try:
        response = requests.post(url, json=data, timeout=10)
        result = response.json()
        
        if result.get('errcode') == 0:

Tainted flow: 'data' from requests.get (line 17, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/delete_drafts.py (reported line 33)May include surrounding context.

python

}
    
    try:
        response = requests.post(url, json=data, timeout=10)
        result = response.json()
        
        if result.get('errcode') == 0:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The usage, examples, troubleshooting, and support sections are all presented only in Chinese, with no note that the skill is region- or language-specific. Although the skill is WeChat-related, the README does not clearly document that the locale constraint is intentional and justified, nor does it offer an opt-in language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language content of the skill is almost entirely in Chinese, including usage instructions, warnings, and setup guidance. Under the policy, a skill that effectively requires a specific language should either offer a language choice or clearly justify the locale restriction; this file does neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

All user-facing comments and echo messages are in Chinese, and the script provides no option to select another language or locale. This can violate language-choice policy when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as requests>=2.25.1, which allows installation of a wide range of versions without guaranteeing a reviewed, fixed release. This weakens supply-chain control and can result in builds pulling different versions over time, including versions with known security issues or behavior changes.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.25.1

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Because requests is not pinned, it is impossible to verify from this manifest whether the installed version includes fixes for known advisories affecting some releases. In a skill that deletes WeChat drafts and likely performs authenticated API calls, use of a vulnerable requests version could increase risk of credential leakage or insecure request handling depending on the runtime-resolved version.

Content

No source excerpt is available for this finding.