文颜

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:17 AM UTC
• Version: 1.0.0

Overview

This is a coherent publishing guide for a WeChat article CLI, with normal but important cautions around third-party installation, credentials, and publishing data.

Before installing, verify the npm package and publisher, avoid using sudo, consider a pinned or local install, and only publish Markdown files and images you are comfortable sending to the configured Wenyan server and WeChat. Store WeChat credentials securely and do not commit or paste them into shared logs or screenshots.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

bash

npm install -g @wenyan-md/cli

Technical Analysis

The installation command retrieves the current version of @wenyan-md/cli without pinning an exact, audited release or verifying package integrity or provenance. Because npm packages and their transitive dependencies can execute lifecycle scripts during installation, a compromised package release, maintainer account, or dependency could cause arbitrary code to run with the privileges of the user invoking npm.

The -g option installs the package globally, increasing its system-wide influence and placing the wenyan executable in the user's global command path. The reviewed project contains neither the package source nor a lockfile or integrity metadata that would make the downloaded implementation reproducible and auditable.

This finding identifies supply-chain exposure in the documented installation procedure. It does not establish that the named package is currently malicious.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or a transitive dependency and publishes a malicious release.
2. A user follows the documented command after that release becomes the version selected by npm.
3. npm downloads the mutable package version and dependency tree.
4. Malicious package code or an installation lifecycle script executes with the invoking user's privileges.
5. The globally installed command can subsequently execute attacker-controlled behavior whenever the user invokes wenyan.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the installing user's account. Depending on that account's permissions, the attacker could access user-readable files and credentials, alter files, make network requests, or install a spoofed global `we ...[truncated 290 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact version that has been reviewed, rather than implicitly installing the latest release.
• Prefer a project-local installation recorded in package.json and a committed lockfile over global installation.
• Use reproducible installation commands such as npm ci where applicable.
• Verify npm package provenance, publisher identity, release signatures, and registry integrity metadata before installation.
• Review the package and transitive dependency lifecycle scripts before approving upgrades.
• Run installation and publishing operations under a dedicated, non-privileged account with access limited to the required article files and credentials.
• Avoid using sudo or an administrator account for npm installation.
• Establish an allowlisted dependency update process with security review and automated vulnerability scanning.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states that the CLI will automatically upload article images to the WeChat media library and implies remote publication, but it does not warn users that article content, metadata, image files, and possibly referenced remote resources will be transmitted to external services. This can lead to unintentional disclosure of sensitive drafts, internal images, or proprietary content when users run the command without understanding the data flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation instructs users to set WECHAT_APP_ID and WECHAT_APP_SECRET environment variables but provides no warning that these values are sensitive credentials requiring careful handling. Users may expose secrets through shell history, shared environments, screenshots, logs, or committing setup snippets into repositories, increasing the risk of credential compromise and unauthorized account access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.