微信公众号自定义主题应用工具

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:23 AM UTC
• Version: 1.0.0

Overview

The skill is a transparent WeChat publishing helper, with expected but sensitive use of account credentials and a third-party CLI.

Install only if you intend agents to publish selected Markdown drafts to a WeChat Official Account. Keep WECHAT_APP_SECRET private, avoid printing environment variables, prefer a pinned or project-local Wenyan CLI install, and confirm the exact Markdown file before running publish.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Global Installation of a Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- **依赖工具**：已安装 `wenyan-cli` (`pnpm add -g @wenyan-md/cli`)。

Technical Analysis

The prerequisite recommends globally installing @wenyan-md/cli without specifying a reviewed version or integrity constraint:

bash

pnpm add -g @wenyan-md/cli

This command resolves a mutable package version from the configured package registry. A future compromised or malicious release could execute package lifecycle scripts during installation or malicious logic when the CLI is invoked. The global installation also increases the exposure of the affected tool beyond this project.

The Skill later directs the Agent to run this CLI in a workflow that requires WECHAT_APP_ID and WECHAT_APP_SECRET. If a malicious package version executes in the same environment, it could access environment variables and other files available to the invoking user.

This finding identifies supply-chain exposure caused by unsafe dependency installation guidance. The audit did not establish that the current package is malicious.

Attack Path

1. An attacker compromises the package, maintainer account, registry publication process, or another relevant supply-chain component.
2. The attacker publishes a malicious version under the expected @wenyan-md/cli package name.
3. A user follows the documented unpinned global installation command.
4. pnpm resolves and installs the attacker-controlled release.
5. Malicious code executes through an installation lifecycle script or when the wenyan command is subsequently invoked.
6. The code operates with the privileges of the invoking user and may access credentials, project files, and globally writable user-level resources available in that execution environment.

Impact Assessment

Suc ...[truncated 607 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @wenyan-md/cli to a specific version that has been reviewed and tested.
• Prefer a project-local dependency governed by a committed lockfile instead of a global installation.
• Verify package provenance and integrity through registry integrity metadata, checksums, signatures, or an approved internal package mirror.
• Review dependency changes before updating the pinned version.
• Disable package lifecycle scripts during installation where operationally feasible, and enable only reviewed scripts when required.
• Run the CLI under a dedicated, least-privileged account or isolated environment.
• Provide WECHAT_APP_ID and WECHAT_APP_SECRET only to the publication process that requires them, rather than exposing them throughout installation, rendering, or theme-registration operations.
• Avoid elevated installation or execution. Document explicitly that the command must not be run as root or with equivalent administrative privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill requires WECHAT_APP_ID and WECHAT_APP_SECRET environment variables but does not warn that these are sensitive credentials tied to a WeChat Official Account. In an agent-driven workflow, omitting credential-handling guidance can lead to accidental exposure in logs, prompts, shell history, screenshots, or debugging output, enabling unauthorized access to publishing capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs agents to publish Markdown content directly to WeChat draft storage, which transmits article content to an external third-party service, but it provides no user-facing disclosure, confirmation step, or warning about data leaving the local environment. In an AI-agent context, this increases the risk of unintentionally exfiltrating sensitive or unpublished content because the workflow presents external publication as a routine step rather than a security-relevant action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.