Weixin WeChat Channel

• Outcome: Review
• Latest audit: May 29, 2026 · 9:34 PM UTC
• Version: 1.0.2

Overview

This skill advertises WeChat article draft automation, but its included executable code mainly performs paid license checks that send a device fingerprint and card key to a plain-HTTP server.

Review carefully before installing. Only use this if you trust the publisher, are comfortable sending a paid card key and stable device fingerprint to the listed licensing server, and can protect your WeChat App Secret. Prefer waiting for HTTPS licensing, clearer data-handling disclosure, and an explicit approval step before any WeChat draft or media is created.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises capabilities that require environment access, filesystem access, and network communication, but it declares no corresponding permissions or user-facing warnings. This creates a transparency and consent problem: operators may invoke the skill for simple writing tasks without realizing it can read secrets, write local files, and contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior extends beyond article drafting into remote license activation, machine fingerprint collection, and local license metadata management, none of which are part of the stated business purpose. Hidden or under-disclosed collection of host identifiers and outbound transmission to a separate authorization server increases privacy, tracking, and supply-chain risk, especially when tied to a monetized activation flow.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The documentation introduces a remote authorization dependency unrelated to the core article-generation workflow, creating an unexpected data flow to a third-party server. Because users may provide card keys and machine-identifying data to an external host over the network, this expands the trust boundary without clear justification in the skill's primary function.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Paid card-key activation and machine/license-status checks are contextually unrelated to generating and saving WeChat drafts, so they represent unexpected functionality with monetization and host-identification implications. Such unrelated features are risky because they can normalize sending sensitive environment or device metadata to a remote service under the guise of ordinary content creation.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code derives a machine fingerprint from hostname, OS, architecture, and MAC-derived data, which is device-identifying information not required for generating or saving WeChat articles. In this skill context, collecting host identity for remote licensing is unrelated to the declared purpose and creates unnecessary tracking/privacy risk, especially because the data is later transmitted to an external server.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The module performs outbound POST requests to a remote licensing server for activation and validation, which is outside the stated content-creation and draft-saving functionality. In an agent skill, undisclosed network egress to a third-party service expands the trust boundary and can leak identifiers or secrets without user expectation or operational need.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The entrypoint for a skill advertised as generating and saving WeChat public account articles performs only license validation, machine fingerprint handling, and status reporting. This functionality mismatch is security-relevant because it hides undisclosed behavior and creates a trust boundary violation: users invoke a content-automation skill but actually execute licensing logic that may gate access, collect identifiers, or contact external systems before any stated task is performed.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script exposes machine fingerprint retrieval and invokes license enforcement through an external-style activation flow that is not necessary for writing or saving WeChat articles. In this skill context, collecting stable device identifiers and performing remote validation increases privacy and supply-chain risk because the user is not invoking a licensing utility but a publishing automation tool, so the behavior is unexpected and can facilitate tracking or undeclared data exfiltration.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README states that the skill will automatically create and save a WeChat public-account draft, but it does not clearly warn that this performs a write action to an external third-party platform using configured credentials. In an agent setting, users may assume content generation is local-only; silent external publication-side effects can lead to unintended content submission, workflow abuse, or accidental disclosure of sensitive draft material.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README instructs users to configure WECHAT_APPID and WECHAT_APPSECRET but does not identify them as sensitive secrets or provide handling guidance. This increases the chance that operators expose credentials in logs, screenshots, shared config files, or bundled distributions, enabling unauthorized access to the connected WeChat account and its publishing capabilities.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill describes automatic draft creation and separate remote license validation, yet it does not clearly warn users about network activity, remote endpoints, or data effects before those actions occur. In a writing-assistant context, implicit side effects are more dangerous because users may expect text generation only, not external communication or persistent changes to third-party accounts.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The default license server uses plain HTTP, so card keys and machine fingerprints sent during activation/check can be intercepted or modified by any network attacker on the path. Because the skill sends both an authentication secret and device-identifying data, lack of transport security materially increases credential theft, spoofing, and privacy compromise risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.