微信公众号文章阅读器

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:27 AM UTC
• Version: 1.0.0

Overview

This WeChat article reader mostly matches its purpose, but its script can fetch any URL and follow redirects, which could expose local or private network services if misused.

Install only if you are comfortable with the skill making outbound web requests from your agent environment. Use it only with trusted WeChat article URLs, and prefer a version that enforces an mp.weixin.qq.com HTTPS allowlist and validates redirect destinations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: weixin_reader.py:31

Finding

Arbitrary URL Fetching and Redirect-Based Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: weixin_reader.py, lines 31-32
Vulnerability Type: Server-Side Request Forgery (SSRF) caused by unrestricted URL fetching
Risk Level: Medium

Vulnerable Code

python

with httpx.Client(follow_redirects=True, timeout=30) as client:
    resp = client.get(url, headers=headers)

Technical Analysis

The URL supplied by the caller is passed directly to httpx.Client.get() without validating its scheme, hostname, port, or resolved IP address. Although SKILL.md states that the skill is intended for mp.weixin.qq.com article URLs, the implementation does not enforce that restriction.

The HTTP client is also configured with follow_redirects=True. Therefore, validating only the initial URL outside this code would be insufficient unless every redirect destination were also checked. An external server could redirect the request to a loopback, private, link-local, or otherwise restricted address.

Requests are made with the network access of the process running the skill. The response is subsequently parsed as HTML. If an internal response contains elements matching the expected WeChat selectors, its content may be printed. Even when extraction fails, response timing and application behavior may permit internal-service probing.

Attack Path

1. An attacker or untrusted user provides an arbitrary URL as the skill's command-line argument.
2. The URL is passed to read_wechat_article() without enforcing the documented WeChat hostname restriction.
3. httpx sends a request to the supplied destination.
4. The attacker may use a direct internal URL, such as a loopback or private-network address, or provide an external URL that redirects to an internal destination.
5. Because redirects are followed automatically without destination validation, the process accesses the resulting target using the Agent host's network position.
6. Internal response characteristics may ...[truncated 927 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce an explicit hostname allowlist containing only mp.weixin.qq.com and any additional WeChat domains that are strictly required and documented.
2. Permit only HTTPS URLs and reject URLs containing credentials, nonstandard ports, ambiguous host representations, or unsupported schemes.
3. Normalize the hostname and perform an exact hostname or properly bounded subdomain comparison; do not use substring matching.
4. Resolve the hostname before connecting and reject all loopback, private, link-local, multicast, reserved, and unspecified IPv4 and IPv6 addresses.
5. Disable automatic redirects and process redirects manually. Apply the same scheme, hostname, port, and resolved-IP checks to every redirect target.
6. Protect against DNS rebinding by ensuring the validated address is the address actually used for the connection, or enforce equivalent restrictions through a controlled outbound proxy.
7. Set limits for response size and redirect count to reduce resource-exhaustion risks.
8. Call resp.raise_for_status() and return sanitized error messages rather than exposing raw network exception details.
9. Apply outbound firewall or proxy controls so the skill cannot access metadata endpoints, loopback services, or private networks even if application validation is bypassed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The request hard-codes both a WeChat user agent advertising Language/zh_CN and an Accept-Language: zh-CN header. This imposes a specific language/locale behavior on all users without opt-in, which matches the policy category for language or locale violations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.