T09 · Insecure Skill Coding Practices
Error
- Location
wechat_api.py:105- Finding
WeChat Access Token Stored in a Plaintext Cache File
- Content
View full analysis
- Remediation
View remediation
Security audit
微信公众号发布工具
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a real WeChat publishing skill, but it needs Review because some bundled tests and helper scripts can perform live account-changing actions unexpectedly and credential handling is under-scoped.
Install only if you are comfortable granting it WeChat publishing credentials and image-provider API keys. Before use, remove or quarantine live tests, avoid running pytest against production credentials, disable or document browser automation, use a test WeChat account first, store tokens in a credential manager instead of .token_cache, and upgrade the image-processing dependency.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
tests/test_debug.py:45- Finding
Test Module Performs Live External Account Operations During Import
- Content
View full analysis
]*>', article['content']) ``` The same unsafe pattern appears in the other affected test modules: a real `WechatPublisher` is instantiated and `create_article()` is called without mocks or an explicit integration-test guard. ### Technical Analysis The code is placed at module scope rather than inside a test function or a guarded `main` block. Test runners such as pytest import test modules during collection. Consequently, collecting this file executes `WechatPublisher()` and `create_article()` automatically. `create_article()` is not a pure rendering function. Its execution path can: - Send article-derived prompts to configured image-generation providers. - Consume paid image-generation quota. - Upload cover and body images to WeChat. - Modify the connected account's media library. - Write generated images, logs, counters, and token-cache data locally. These effects occur without a test marker, mock transport, isolated test account, or explicit confirmation. ### Attack Path 1. A user or CI system runs `pytest`, performs test discovery, or imports the test module. 2. Python executes the module-level statements during import. 3. `WechatPublisher()` loads the default configuration and real credentials. 4. `create_article()` generates or retrieves images through enabled external providers. 5. Generated images are uploaded to the configured WeChat account. 6. Provider quota may be consumed and article-derived data may be transmitted even though the operator only i ...[truncated 542 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
image_gen.py:107- Finding
Configurable Image Provider Endpoints Receive Production API Credentials Without Origin Validation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
publish.py:230- Finding
User-Supplied Article HTML Is Rendered Without the Declared Sanitization Controls
- Content
View full analysis
- Remediation
View remediation
` tags, mixed-case handlers, encoded `javascript:` URLs, malformed HTML, SVG payloads, and injected attributes. ]]>
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (134)
Tainted flow: 'params' from os.environ.get (line 34, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python "appid": APPID, "secret": APPSECRET } resp = requests.get(url, params=params) data = resp.json() if "access_token" in data:
Tainted flow: 'params' from os.environ.get (line 34, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python url = "https://api.weixin.qq.com/cgi-bin/get_api_quota" params = {"access_token": token} data = {"cgi_path": "/cgi-bin/draft/add"} resp = requests.post(url, params=params, json=data) result = resp.json() if "quota" in result:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
f.write(encrypted)
方案 2: 使用系统密钥链 (macOS/Linux)
import keyring keyring.set_password("wechat_mp", "access_token", self._access_token)
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
f.write(encrypted)
方案 2: 使用系统密钥链 (macOS/Linux)
import keyring keyring.set_password("wechat_mp", "access_token", self._access_token)
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
f.write(encrypted)
方案 2: 使用系统密钥链 (macOS/Linux)
import keyring keyring.set_password("wechat_mp", "access_token", self._access_token)
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
f.write(encrypted)
方案 2: 使用系统密钥链 (macOS/Linux)
import keyring keyring.set_password("wechat_mp", "access_token", self._access_token)
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
f.write(encrypted)
方案 2: 使用系统密钥链 (macOS/Linux)
import keyring keyring.set_password("wechat_mp", "access_token", self._access_token)
text
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented API surface goes beyond simple article drafting and publishing by advertising functions like publish_all and by referencing broader account operations in the core API wrapper description, while the high-level skill description frames the tool more narrowly as a publishing utility. Capability overreach in a content-publishing skill is dangerous because it may grant access to audience/account data or enable mass actions beyond what a user expects when invoking a publishing task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented API surface goes beyond simple article drafting and publishing by advertising functions like publish_all and by referencing broader account operations in the core API wrapper description, while the high-level skill description frames the tool more narrowly as a publishing utility. Capability overreach in a content-publishing skill is dangerous because it may grant access to audience/account data or enable mass actions beyond what a user expects when invoking a publishing task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented API surface goes beyond simple article drafting and publishing by advertising functions like publish_all and by referencing broader account operations in the core API wrapper description, while the high-level skill description frames the tool more narrowly as a publishing utility. Capability overreach in a content-publishing skill is dangerous because it may grant access to audience/account data or enable mass actions beyond what a user expects when invoking a publishing task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented API surface goes beyond simple article drafting and publishing by advertising functions like publish_all and by referencing broader account operations in the core API wrapper description, while the high-level skill description frames the tool more narrowly as a publishing utility. Capability overreach in a content-publishing skill is dangerous because it may grant access to audience/account data or enable mass actions beyond what a user expects when invoking a publishing task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented API surface goes beyond simple article drafting and publishing by advertising functions like publish_all and by referencing broader account operations in the core API wrapper description, while the high-level skill description frames the tool more narrowly as a publishing utility. Capability overreach in a content-publishing skill is dangerous because it may grant access to audience/account data or enable mass actions beyond what a user expects when invoking a publishing task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented API surface goes beyond simple article drafting and publishing by advertising functions like publish_all and by referencing broader account operations in the core API wrapper description, while the high-level skill description frames the tool more narrowly as a publishing utility. Capability overreach in a content-publishing skill is dangerous because it may grant access to audience/account data or enable mass actions beyond what a user expects when invoking a publishing task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented API surface goes beyond simple article drafting and publishing by advertising functions like publish_all and by referencing broader account operations in the core API wrapper description, while the high-level skill description frames the tool more narrowly as a publishing utility. Capability overreach in a content-publishing skill is dangerous because it may grant access to audience/account data or enable mass actions beyond what a user expects when invoking a publishing task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented API surface goes beyond simple article drafting and publishing by advertising functions like publish_all and by referencing broader account operations in the core API wrapper description, while the high-level skill description frames the tool more narrowly as a publishing utility. Capability overreach in a content-publishing skill is dangerous because it may grant access to audience/account data or enable mass actions beyond what a user expects when invoking a publishing task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented API surface goes beyond simple article drafting and publishing by advertising functions like publish_all and by referencing broader account operations in the core API wrapper description, while the high-level skill description frames the tool more narrowly as a publishing utility. Capability overreach in a content-publishing skill is dangerous because it may grant access to audience/account data or enable mass actions beyond what a user expects when invoking a publishing task.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented API surface goes beyond simple article drafting and publishing by advertising functions like publish_all and by referencing broader account operations in the core API wrapper description, while the high-level skill description frames the tool more narrowly as a publishing utility. Capability overreach in a content-publishing skill is dangerous because it may grant access to audience/account data or enable mass actions beyond what a user expects when invoking a publishing task.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a tool for publishing WeChat articles via official APIs with image selection, template rendering, and draft/publish modes. This file instead reads and rewrites local .log files to redact tokens, media IDs, draft IDs, and image URLs, which is a separate maintenance/sanitization function not reflected in the stated skill behavior.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ] # 需要检查的文件扩展名 TARGET_EXTENSIONS = {'.py', '.json', '.yaml', '.yml', '.md', '.txt', '.env'} # 需要跳过的目录 SKIP_DIRS = {'venv', '__pycache__', '.git', 'node_modules', '.venv'}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python ] # 需要检查的文件扩展名 TARGET_EXTENSIONS = {'.py', '.json', '.yaml', '.yml', '.md', '.txt', '.env'} # 需要跳过的目录 SKIP_DIRS = {'venv', '__pycache__', '.git', 'node_modules', '.venv'}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 读取各图片源详细配置 providers_config = self.config.get('providers', {}) # 加载环境变量（支持 .env 文件） from dotenv import load_dotenv load_dotenv()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 读取各图片源详细配置 providers_config = self.config.get('providers', {}) # 加载环境变量（支持 .env 文件） from dotenv import load_dotenv load_dotenv()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # 读取各图片源详细配置 providers_config = self.config.get('providers', {}) # 加载环境变量（支持 .env 文件） from dotenv import load_dotenv load_dotenv()
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata and file header claim an official-API-based publishing tool, but the implementation instead automates the WeChat admin web UI through a browser. This is dangerous because users may grant trust, credentials, and permissions under a false security model; UI automation is more brittle, may violate platform expectations, and can perform unintended state-changing actions in an authenticated session.
- Content
Known Vulnerable Dependency: Pillow==10.2.0 — 16 advisory(ies): CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`); CVE-2026-55798 (Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pat) +13 more
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Pillow 10.2.0 is a true vulnerable dependency with multiple image-parsing and related advisories. This skill explicitly supports intelligent image handling, so untrusted or remotely sourced images are likely part of normal operation, which increases the chance that malformed image inputs could trigger denial of service, memory corruption, or other parser-level issues.
- Content
Static analysis
No suspicious patterns detected.