wechat-publisher

• Outcome: Pass
• Latest audit: Sep 17, 2026 · 4:35 AM UTC
• Version: 2.0.0

Overview

This is a disclosed WeChat publishing helper that uses WeChat credentials to upload drafts and images, with local token/cache files users should handle carefully.

Install only if you intend to let this skill use your WeChat Official Account API credentials to upload Markdown content and images to WeChat drafts. Keep the credential file private, review rendered output before publishing, avoid sensitive/internal drafts unless they are meant for WeChat, and delete or protect the local token cache if the machine is shared.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (40)

Tainted flow: 'params' from os.environ.get (line 36, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/wechat-image-post.py (reported line 37)May include surrounding context.

python

def get_access_token():
    """获取 access_token"""
    params = {"grant_type": "client_credential", "appid": APP_ID, "secret": APP_SECRET}
    resp = requests.get(TOKEN_URL, params=params, timeout=15)
    data = resp.json()
    if "access_token" not in data:
        raise RuntimeError(f"获取 token 失败: {data}")

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

One aspect of this mismatch is security-relevant: the skill appears to read WeChat credentials and call external APIs while declaring no permissions. Even if the broader behavioral mismatch is uncertain, failing to disclose credential and network use can mislead users into granting trust to a skill that uploads content and accesses secrets.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The documented workflow sources credentials from ~/.wechat-credentials.env, which means the skill depends on loading sensitive secrets into the process environment. This is dangerous if not prominently disclosed and tightly scoped, because secrets may be exposed to subprocesses, logs, shell history, or other tooling invoked during publishing.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

2. 发布命令

bash

source ~/.wechat-credentials.env
bash ~/.workbuddy/skills/wechat-publisher/scripts/publish.sh /path/to/article.md

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

This second documented command again relies on sourcing a credential file before invoking the publishing script, confirming that secret access is a core behavior. Because the skill also performs network publication, compromise or misuse of these credentials could allow unauthorized content publication or account abuse.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

2. 发布命令

bash

source ~/.wechat-credentials.env
$HOME/.workbuddy/binaries/python/envs/default/bin/python3 \
  ~/.workbuddy/skills/wechat-publisher/scripts/wechat-image-post.py /path/to/post.md

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 142)May include surrounding context.

1. 40125：AppSecret 错误，到后台重置并更新凭证文件
2. 40001：脚本已内置自动重试（清缓存 + force_refresh），若仍失败：

   bash

   rm ~/.config/wechat-publisher/token.json
   

   然后重试。

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 157)May include surrounding context.

（md5 去重，同一张图不重复占素材额度）。如遇素材异常：

bash

rm ~/.config/wechat-publisher/upload-cache.json

---

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/css_inline.py (reported line 361)May include surrounding context.

python

if selectors and declarations:
            rules.append(Rule(selectors, declarations, order))
            order += 1
    return rules


def collect_css_variables(css_text):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 47)May include surrounding context.

md

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish.sh (reported line 16)May include surrounding context.

sh

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/publish.sh (reported line 17)May include surrounding context.

sh

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 5)May include surrounding context.

sh

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wechat-image-post.py (reported line 160)May include surrounding context.

python

# setup.sh - 从凭证文件加载微信公众号环境变量
# Usage: source ./scripts/setup.sh

CRED_FILE="${WECHAT_CRED_FILE:-$HOME/.wechat-credentials.env}"

# 检查凭证文件是否存在
if [ ! -f "$CRED_FILE" ]; then

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill explicitly declares allowed-tools: null while the documentation describes capabilities that require environment access, file I/O, network access, and shell execution. This mismatch weakens review and consent boundaries because users cannot accurately tell what resources the skill will access before running it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description omits a clear privacy and data-handling warning that article text, images, and related metadata are uploaded to WeChat servers. In a publishing skill, this context increases risk because users may unknowingly send sensitive drafts, internal images, or proprietary content to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example promotes one-click publishing and automatic image handling but does not warn users that article content, local images, and possibly remote images will be uploaded to an external WeChat service using configured credentials. This can cause unintentional disclosure of sensitive content or assets, especially because the workflow is framed as simple and automatic, reducing the chance that users pause to consider data transfer boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The renderer explicitly passes embedded HTML blocks through unchanged via _collect_html_block() and appends them directly to output. If untrusted Markdown is processed, attackers can inject active or unsafe HTML such as phishing links, tracking elements, or platform-specific markup that survives rendering and may be published to downstream consumers.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring states '不依赖任何第三方包，Python 3.9+ 可运行', indicating no third-party dependencies. However, add_footnotes later imports and uses css_inline, so the documentation actively contradicts the implementation rather than merely omitting a detail.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/md_render.py (reported line 121)May include surrounding context.

python

"if then else elif fi for while in do done case esac function select "
        "time until return exit break continue local export readonly declare "
        "typeset unset shift source alias echo cd pwd ls mkdir rm cp mv cat "
        "grep sed awk find xargs which sudo apt brew pip npm git curl wget tar "
        "chmod chown kill ps"
    ),
    "css": (

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code file contains natural-language instructions, usage text, and runtime messages entirely in Chinese, which effectively forces a specific language for users. The file does not offer an opt-in language choice or explain that the skill is intended only for a Chinese-language or region-specific audience.

Content

No source excerpt is available for this finding.