微信公众号文章发布工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:27 AM UTC
• Version: 1.0.1

Overview

This skill does what it says, but it can publish live WeChat content using account credentials and relies on an unpinned global third-party CLI install.

Review carefully before installing. Use this only in an isolated environment, pin and verify the Wenyan CLI version, inject WeChat credentials securely only at publish time, and require an explicit final confirmation before any live publish command or image upload.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Global Installation of a Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Complete Code Snippet:

markdown

- **依赖工具**：已安装 `wenyan-cli` (`pnpm add -g @wenyan-md/cli`)。

Technical Analysis

The documented command installs the latest available version of @wenyan-md/cli globally without a pinned version, project lockfile, or integrity verification. The effective package contents can therefore change after this Skill has been reviewed.

Package installation may also run npm-compatible lifecycle scripts. If the package, one of its transitive dependencies, or a future release is compromised, installation could execute attacker-controlled code with the privileges of the user running pnpm. Global installation unnecessarily broadens the trust and impact boundary.

Attack Path

1. An attacker compromises @wenyan-md/cli, one of its transitive dependencies, or the relevant package-publishing account.
2. The attacker publishes a malicious release or causes a malicious dependency version to be resolved.
3. A user follows the Skill's unpinned command:

   bash

   pnpm add -g @wenyan-md/cli
   

4. The package manager retrieves the attacker-controlled version.
5. Malicious package contents or lifecycle scripts execute with the installing user's privileges.
6. If WeChat credentials are present in the process environment, the malicious code may attempt to read and disclose them or abuse them to interact with the associated WeChat account.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Accessible resources may include files readable or writable by that user, environment variables, package-manager configuration, and network-accessible services.

Because the Skill requires WECHAT_APP_ID and WECHAT_APP_SECRET, those credentials may be exposed ...[truncated 325 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @wenyan-md/cli to a specifically reviewed version rather than resolving the latest release.
2. Install it as a project-local development dependency instead of globally:

   bash

   pnpm add --save-dev --save-exact @wenyan-md/cli@<reviewed-version>
   

3. Commit the resulting pnpm-lock.yaml and use frozen-lockfile installation in controlled environments:

   bash

   pnpm install --frozen-lockfile
   

4. Verify package provenance, publisher identity, checksums, signatures, and lifecycle scripts before approving upgrades.
5. Review transitive dependency changes whenever the pinned version or lockfile is updated.
6. Run the publisher in a least-privileged, isolated environment with access limited to the required article assets and network destinations.
7. Expose WECHAT_APP_ID and WECHAT_APP_SECRET only to the publishing process, not to dependency installation. Store them in an appropriate secret manager and rotate them if compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes direct publishing to a WeChat Official Account and automatic image syncing, but it does not prominently warn that using it will transmit article content and image assets to external WeChat services and may immediately affect a live account. In an agent context, this raises the risk of unintended publication, privacy leakage, or accidental disclosure of unpublished material because the action is side-effectful and externally visible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill requires WECHAT_APP_ID and WECHAT_APP_SECRET environment variables but does not include guidance on secure handling, scope, or avoiding exposure in logs and prompts. In an AI-agent workflow, missing credential-safety guidance increases the chance that secrets are mishandled, echoed back to users, or stored insecurely during troubleshooting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.