Security audit

Wechat Mp Toolkit

Security checks for vulnerabilities and agentic risk

Overview

This WeChat publishing skill mostly does what it says, but it ships real-looking WeChat credentials and runs publishing automation with under-scoped safeguards.

Review this carefully before installing. Do not run it with the bundled credentials, rotate them if they belong to you, replace them with environment-provided secrets, and avoid the one-click publish workflow until it has a dry-run or confirmation step and the external cover-generator execution is removed or integrity-checked.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/full-workflow.js:13
Finding: Hard-Coded WeChat Application Credentials
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/full-workflow.js:162
Finding: Execution of Mutable Code Outside the Audited Skill Boundary
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The high-level description broadly matches the intended workflow: hotspot analysis, article creation, cover generation, and automatic WeChat publishing are all present in the code. However, there is a significant description-behavior mismatch because the declared permissions are empty while the code performs sensitive external actions: it embeds appID/appSecret, authenticates to the WeChat API, uploads media, creates drafts, scrapes a third-party news site, writes to local directories, and invokes external executables/scripts. These are materially important capabilities and resource accesses that should be declared. Therefore this should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个较宽泛的微信公众号运营工具包，包含文章创作、封面生成、自动发布、热点分析等多项能力；但该代码块的实际用途明显更窄：它读取指定本地文章文件，提取标题和摘要，生成简单封面，上传到微信素材库，并创建公众号草稿。它并不实现热点分析或文章创作，也不是直接“自动发布”到正式发布状态，而是发布到草稿箱。此外，代码硬编码了 appID 和 appSecret，并实际访问微信外部 API、上传本地内容，这属于重要的行为细节，声明中没有准确体现。因此描述与实际行为存在实质不匹配。
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
node scripts/full-workflow.js

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 90% confidence
Finding: The lockfile pins axios 1.13.6, and the finding cites multiple advisories including SSRF-related proxy bypass and prototype-pollution-assisted request/response compromise issues. In a toolkit that performs article creation, cover generation, and automatic publishing, outbound HTTP requests are likely core functionality, so a vulnerable HTTP client meaningfully increases risk of server-side request forgery, credential leakage, request tampering, or MITM-style abuse depending on how the package is used.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 86% confidence
Finding: form-data 4.0.5 is reported vulnerable to CRLF injection via unescaped multipart field names and filenames. This skill context includes cover generation and auto-publishing, which likely involves file upload and multipart requests; if attacker-controlled metadata reaches multipart construction, it could corrupt requests, inject unintended parts or headers, and potentially abuse downstream services.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The resolved axios version is flagged with multiple advisories, including SSRF-related proxy bypass and severe prototype-pollution-assisted interception issues. In a tool that likely performs authenticated HTTP requests for WeChat automation, exploitation could enable credential theft, request hijacking, SSRF, or manipulation of outbound publishing workflows.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The resolved form-data version is reported vulnerable to CRLF injection via unescaped multipart field names/filenames, which can corrupt multipart requests or inject unintended headers/content boundaries. In a skill that likely uploads article assets or covers, this could be abused if any multipart field metadata is influenced by untrusted input.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script hardcodes a WeChat appID and appSecret directly in source code, then uses them to obtain an access token and publish content. Embedded secrets are easily exposed through source distribution, logs, backups, or repository history, enabling unauthorized API access and account abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script embeds a live WeChat appID and appSecret directly in source code and then uses them to obtain access tokens for publication. Hard-coded secrets are easily exposed through source sharing, logs, backups, or repository history, enabling unauthorized use of the associated WeChat account and API capabilities.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/full-workflow.js (reported line 209)May include surrounding context.
js
log(`开始发布文章: ${path.basename(articlePath)}`, 'process'); try { // 1. 获取 access token log('步骤1: 获取 Access Token...', 'process'); const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`; const tokenResponse = await axios.get(tokenUrl, { timeout: 10000 });

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish-existing.js (reported line 37)May include surrounding context.
js
log(`开始发布文章: ${path.basename(articlePath)}`, 'process'); try { // 1. 获取 access token log('步骤1: 获取 Access Token...', 'process'); const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`; const tokenResponse = await axios.get(tokenUrl, { timeout: 10000 });

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/full-workflow.js (reported line 218)May include surrounding context.
js
try { // 1. 获取 access token log('步骤1: 获取 Access Token...', 'process'); const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`; const tokenResponse = await axios.get(tokenUrl, { timeout: 10000 });

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish-existing.js (reported line 38)May include surrounding context.
js
try { // 1. 获取 access token log('步骤1: 获取 Access Token...', 'process'); const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`; const tokenResponse = await axios.get(tokenUrl, { timeout: 10000 });

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/publish-existing.js (reported line 47)May include surrounding context.
js
try { // 1. 获取 access token log('步骤1: 获取 Access Token...', 'process'); const tokenUrl = `${config.apiBase}/cgi-bin/token?grant_type=client_credential&appid=${config.appID}&secret=${config.appSecret}`; const tokenResponse = await axios.get(tokenUrl, { timeout: 10000 });

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs users to run a one-click workflow that performs remote fetching, content generation, and publishing to a WeChat draft box without any warning, confirmation step, or disclosure of outbound network activity. In a skill explicitly designed for automated公众号运营, this increases the chance that a user executes publishing-related automation before understanding what external systems are contacted or what actions are taken with their account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README tells users to place appID and appSecret directly into a local JSON config file but provides no warning about secret handling, file permissions, accidental commits, or safer alternatives. Because these credentials grant access to a publishing account, poor storage guidance can lead to credential leakage and unauthorized use of the associated WeChat公众号.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 84)May include surrounding context.
md
## 常见问题 **Q: 封面生成失败？** A: 确保已安装 ImageMagick：`sudo apt-get install imagemagick` **Q: 发布失败？** A: 检查 appID 和 appSecret 是否正确

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
## 常见问题 **Q: 封面生成失败？** A: 确保已安装 ImageMagick：`sudo apt-get install imagemagick` **Q: 发布失败？** A: 检查 appID 和 appSecret 是否正确

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documents destructive or data-modifying actions such as one-click publishing, uploading media, and automatic cleanup of old drafts without a prominent warning or confirmation requirement. In an automation context, users may run these commands assuming they are read-only helpers, leading to unintended publication, deletion, or account-side state changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The configuration example includes an appSecret in plain JSON without any warning about secret handling. This encourages storing long-lived credentials in files that may be committed, copied, or exposed through logs, enabling unauthorized access to the WeChat account APIs if leaked.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
sudo apt-get install imagemagick

安装ImageMagick（CentOS/RHEL）

sudo yum install imagemagick

text
## 工作流程

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest and main feature list describe a toolkit centered on article creation, cover generation, auto-publishing, and hotspot analysis, with a directory structure listing only six scripts. However, the advanced section documents additional operational capabilities such as batch publishing and statistics via batch-publish.js and stats.js, which are not declared in the directory structure or core feature set. This creates a semantic mismatch between the skill's claimed scope and the behavior/capabilities the documentation says it supports.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Several configuration values prescribe Chinese-language branding and writing structure, such as the brand, author, signature, and article structure text, without indicating that users can opt into another language or locale. This can violate language/locale policy when a skill implicitly forces a specific language for generated output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script's natural-language instructions, generated article template, logs, and publishing target are all fixed in Chinese, indicating a locale-specific behavior. There is no user opt-in, language selection mechanism, or documented justification that the skill is intentionally limited to a Chinese-language workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest describes article creation, cover generation, auto-publishing, and hotspot analysis for WeChat operations. While those outcomes fit the purpose, invoking an unrelated external skill script via execSync and later shelling out to system tools introduces code-execution capability that is not justified by the stated business function itself.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T07 · Tool Hijacking and Spoofing

SkillSpector

Tp4

Tp4

Ae1

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

Missing User Warnings

Missing User Warnings

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

安装ImageMagick（CentOS/RHEL）

Description-Behavior Mismatch

Natural-Language Policy Violations

Natural-Language Policy Violations

Context-Inappropriate Capability