wechat-publisher

• Outcome: Pass
• Latest audit: Sep 17, 2026 · 4:35 AM UTC
• Version: 2.0.0

Overview

This is a disclosed WeChat publishing helper that uses WeChat credentials to upload drafts and images, with local token/cache files users should handle carefully.

Install only if you intend to let this skill use your WeChat Official Account API credentials to upload Markdown content and images to WeChat drafts. Keep the credential file private, review rendered output before publishing, avoid sensitive/internal drafts unless they are meant for WeChat, and delete or protect the local token cache if the machine is shared.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (40)

Tainted flow: 'params' from os.environ.get (line 36, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

def get_access_token():
    """获取 access_token"""
    params = {"grant_type": "client_credential", "appid": APP_ID, "secret": APP_SECRET}
    resp = requests.get(TOKEN_URL, params=params, timeout=15)
    data = resp.json()
    if "access_token" not in data:
        raise RuntimeError(f"获取 token 失败: {data}")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Credential Access

High

• Category: Privilege Escalation

Content

### 2. 发布命令

```bash
source ~/.wechat-credentials.env
bash ~/.workbuddy/skills/wechat-publisher/scripts/publish.sh /path/to/article.md
```

• Confidence: 92% confidence
• Finding: The documented workflow sources credentials from `~/.wechat-credentials.env`, which means the skill depends on loading sensitive secrets into the process environment. This is dangerous if not prominently disclosed and tightly scoped, because secrets may be exposed to subprocesses, logs, shell history, or other tooling invoked during publishing.

Credential Access

High

• Category: Privilege Escalation

Content

### 2. 发布命令

```bash
source ~/.wechat-credentials.env
$HOME/.workbuddy/binaries/python/envs/default/bin/python3 \
  ~/.workbuddy/skills/wechat-publisher/scripts/wechat-image-post.py /path/to/post.md
```

• Confidence: 92% confidence
• Finding: This second documented command again relies on sourcing a credential file before invoking the publishing script, confirming that secret access is a core behavior. Because the skill also performs network publication, compromise or misuse of these credentials could allow unauthorized content publication or account abuse.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1. `40125`：AppSecret 错误，到后台重置并更新凭证文件
2. `40001`：脚本已内置自动重试（清缓存 + force_refresh），若仍失败：
   ```bash
   rm ~/.config/wechat-publisher/token.json
   ```
   然后重试。

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

（md5 去重，同一张图不重复占素材额度）。如遇素材异常：

```bash
rm ~/.config/wechat-publisher/upload-cache.json
```

---

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

if selectors and declarations:
            rules.append(Rule(selectors, declarations, order))
            order += 1
    return rules


def collect_css_variables(css_text):

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Credential Access

High

• Category: Privilege Escalation

Content

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly declares `allowed-tools: null` while the documentation describes capabilities that require environment access, file I/O, network access, and shell execution. This mismatch weakens review and consent boundaries because users cannot accurately tell what resources the skill will access before running it.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description omits a clear privacy and data-handling warning that article text, images, and related metadata are uploaded to WeChat servers. In a publishing skill, this context increases risk because users may unknowingly send sensitive drafts, internal images, or proprietary content to a third party.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example promotes one-click publishing and automatic image handling but does not warn users that article content, local images, and possibly remote images will be uploaded to an external WeChat service using configured credentials. This can cause unintentional disclosure of sensitive content or assets, especially because the workflow is framed as simple and automatic, reducing the chance that users pause to consider data transfer boundaries.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The renderer explicitly passes embedded HTML blocks through unchanged via `_collect_html_block()` and appends them directly to output. If untrusted Markdown is processed, attackers can inject active or unsafe HTML such as phishing links, tracking elements, or platform-specific markup that survives rendering and may be published to downstream consumers.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The module docstring states '不依赖任何第三方包，Python 3.9+ 可运行', indicating no third-party dependencies. However, `add_footnotes` later imports and uses `css_inline`, so the documentation actively contradicts the implementation rather than merely omitting a detail.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

"if then else elif fi for while in do done case esac function select "
        "time until return exit break continue local export readonly declare "
        "typeset unset shift source alias echo cd pwd ls mkdir rm cp mv cat "
        "grep sed awk find xargs which sudo apt brew pip npm git curl wget tar "
        "chmod chown kill ps"
    ),
    "css": (

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This code file contains natural-language instructions, usage text, and runtime messages entirely in Chinese, which effectively forces a specific language for users. The file does not offer an opt-in language choice or explain that the skill is intended only for a Chinese-language or region-specific audience.

Static analysis

No suspicious patterns detected.