WeChat Social Automation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:44 AM UTC
• Version: 0.1.1

Overview

This skill is only documentation, but it asks users to configure sensitive WeChat credentials and describes public posting and follower profiling without enough scoping or safeguards.

Review carefully before installing. Do not put a real WeChat AppSecret in TOOLS.md or any shared project file; use protected environment injection or a secrets manager and rotate any secret already stored there. Treat publish, schedule, fan management, and profiling requests as potentially public or privacy-impacting actions that should require explicit confirmation and compliance review.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:20

Finding

Plaintext WeChat application secret storage in agent-readable configuration

Content

View full analysis

Vulnerability Details

File Location: README.md:20-21; equivalent plaintext configuration guidance also appears in SKILL.md:56-57
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code

markdown

- AppID: wx1234567890abcdef
- AppSecret: your-app-secret-here

Technical Analysis

The setup documentation instructs users to place a WeChat AppSecret directly in a Markdown configuration file named TOOLS.md. This stores a sensitive credential as plaintext in a file that may be accessible to the agent, source-control tooling, backups, logging systems, or other users and processes with access to the project workspace.

Although SKILL.md also documents environment-variable configuration, it presents plaintext file storage as a supported alternative without requiring access restrictions, secret redaction, repository exclusions, or a dedicated secret manager.

The repository does not contain an implemented API client or executable code. Therefore, the confirmed issue is the insecure credential-handling guidance rather than active credential theft.

Attack Path

1. A user follows the documented setup procedure and writes a valid WeChat AppSecret into TOOLS.md.
2. The plaintext file is exposed through an accidental source-control commit, workspace backup, diagnostic archive, agent file access, log output, or another local process.
3. An attacker extracts the AppID and AppSecret.
4. The attacker attempts to exchange those credentials for WeChat API access tokens.
5. If WeChat-side controls such as IP allowlisting do not prevent access, the attacker invokes APIs available to the affected application until the secret is revoked or rotated.

Impact Assessment

Successful exploitation could disclose credentials associated with the configured WeChat account. The resulting privileges are limited to the API permissions granted to that application and any platf ...[truncated 393 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove instructions that place AppSecret values directly in TOOLS.md or any other agent-readable Markdown file.
2. Require credentials to be supplied through a protected secret manager or runtime environment-variable injection mechanism.
3. Store only variable references in documentation and configuration, for example AppSecret: ${WECHAT_APP_SECRET}.
4. Add TOOLS.md, local environment files, and other secret-bearing files to .gitignore where applicable, while noting that ignore rules do not protect files already committed.
5. Restrict credential-file permissions to the minimum required account and process if file-backed secrets cannot be avoided.
6. Ensure application and agent logs redact AppSecret values, access tokens, authorization headers, and related credentials.
7. Enable applicable WeChat-side restrictions, including least-privilege API permissions and IP allowlisting.
8. Document immediate secret revocation and rotation procedures for credentials that may already have been stored or committed in plaintext.
9. Add automated secret scanning to repository and release workflows before distributing the skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README instructs users to place a WeChat AppSecret directly in TOOLS.md without any guidance on secure secret handling. Storing credentials in documentation or workspace files can lead to accidental exposure through source control, logs, sharing, or downstream tooling, enabling unauthorized access to the WeChat account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README promotes article publishing and scheduled pushes to a public WeChat account without clearly warning that actions may result in automatic public posting. In an automation context, unclear disclosure increases the risk of unintended publication, reputational damage, and accidental dissemination of sensitive or unreviewed content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is broad enough to match common conversational terms such as '微信', '发布', and '推送', which can cause the skill to activate unintentionally during unrelated chats. Because this skill is designed for account-affecting automation, accidental invocation could lead to unintended publishing workflows or exposure of operational capabilities in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises automated posting, interaction monitoring, fan analysis, and user profiling without any visible warning about privacy, platform-policy compliance, consent, or the risks of account-impacting actions. In this context, users may be encouraged to process follower data or automate social actions without understanding legal, privacy, or account suspension consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs users to place sensitive credentials, including AppSecret, into TOOLS.md, a general configuration document, without any guidance on secure storage or access controls. This increases the chance that long-lived secrets are exposed to other tools, logs, version control, or unauthorized users, enabling takeover of the linked WeChat public account integration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The README content, including usage instructions and examples, is effectively fixed to Chinese, which may impose a language constraint on users without opt-in. The policy allows locale constraints when they are clearly documented and justified, but this file does not explicitly state that the skill is Chinese-language only or offer alternatives.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README describes a broad WeChat social automation skill, but the development checklist explicitly states that the WeChat API integration, publishing, analytics, and scheduling features are not yet implemented. This creates a direct documentation-level contradiction with the earlier feature and usage sections that present those capabilities as available.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.