T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wechat_extractor.py:54- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
mp-weixin
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it says, but it encourages anti-bot/CAPTCHA workarounds and fetches arbitrary URLs without enforcing its stated WeChat-only scope.
Install only if you are comfortable with a scraper-style tool that can make network requests from your environment. Avoid using logged-in cookies or trying to bypass CAPTCHA/anti-bot controls, run it in an isolated environment, and provide only intended WeChat article URLs. Treat /tmp/wechat_article.json as containing copied article data and remove or relocate it as needed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wechat_extractor.py:298- Finding
Predictable Temporary Output Path Enables Symlink-Based File Overwrite
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:21- Finding
Unpinned Third-Party Dependencies Create Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: requests== --hash=sha256: lxml== --hash=sha256: ``` ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation explicitly claims that using a WeChat User-Agent can 'bypass CAPTCHA,' which encourages evasion of anti-bot protections. Guidance that normalizes defeating access controls can enable scraping at scale, increase legal/compliance risk, and push users toward behavior that may violate platform restrictions.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Recommending the use of logged-in cookies to handle anti-scraping controls encourages users to inject authenticated session material into the scraper. This increases the chance of account/session compromise, unauthorized access, and collection of content behind user-specific protections.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill advertises and documents network access and local file output behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent setting, this weakens least-privilege controls and makes it harder for users or runtimes to understand that the skill can fetch remote content and write extracted data locally.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a skill for extracting metadata and正文内容 from WeChat articles and converting them to structured data. In addition to extraction, the script persists the full result to /tmp/wechat_article.json, which is a side effect not stated in the skill description and goes beyond a purely extract/return workflow.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file includes an example that saves extracted article content and metadata to
article.json, and later shows output saved to/tmp/wechat_article.json. Although this is part of the workflow, the documentation does not explicitly warn users that article data will be persisted locally, which may matter for privacy or data-handling expectations.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The docstring and all user-facing messages are written only in Chinese, including usage guidance and success/error output. Under the policy criteria, this is a locale/language constraint without user opt-in or an explicitly documented region-specific justification in the file.
- Content