Security audit

WeChat to Obsidian

Security checks for vulnerabilities and agentic risk

Overview

The skill’s clipping workflow is coherent, but its unpinned global installer and shell-based URL handling deserve review before use.

Review this before installing. Use it only with WeChat article links you intend to clip, prefer a pinned/local install of agent-browser if possible, and confirm the destination vault path carefully. Avoid running the shown shell commands with arbitrary or edited URLs unless they have been validated as HTTPS WeChat article/image URLs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:60
Finding: Unpinned Global Installation of an Executable Third-Party Dependency
Content: View full analysis
Remediation: View remediation
``` 2. Prefer a project-local installation and invoke it through a locked package script or a similarly controlled mechanism instead of using `npm install -g`. 3. Commit and verify a lockfile containing npm integrity metadata. 4. Document the expected package publisher, source repository, and reviewed release checksum. 5. Disable lifecycle scripts during installation where compatible: ```bash npm ci --ignore-scripts ``` 6. If installation scripts are required, audit them separately and document the external components downloaded by `agent-browser install`. 7. Run browser automation in a sandbox or restricted account with access only to the required output directory. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:260
Finding: Unvalidated URLs Interpolated into Shell Command Templates
Content: View full analysis
" ``` Page-derived image URL at `SKILL.md:260-263`: ```bash curl -s -L --fail \ -A 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36' \ -e 'https://mp.weixin.qq.com/' \ "" -o "/attachments/" ``` Batch download function at `SKILL.md:275-285`: ```bash download_img() { local idx=$1 url=$2 local ext="png" echo "$url" | grep -q "wx_fmt=jpeg" && ext="jpg" local fname=$(printf "-图%02d.%s" "$idx" "$ext") curl -s -L --fail \ -A 'Mozilla/5.0' \ -e 'https://mp.weixin.qq.com/' \ "$url" -o "$fname" \ && echo "OK $fname" || echo "FAIL $fname" } ``` ### Technical Analysis The Skill directs an Agent to substitute a user-provided article URL and page-derived image URLs into shell command templates. Although the placeholders are shown inside double quotes, the instructions do not require structured argument passing, canonical URL parsing, or escaping before the Agent constructs the command. If raw input containing a quote, command substitution, newline, or other shell syntax is inserted into the command text before shell parsing, it can break out of the intended quoted argument. Quoting a shell variable inside the batch function is safer after assignment, but the example does not safely demonstrate how attacker-controlled arguments are passed into that function. The commands also lack a strict URL allowlist. `curl -L` follows redirects, so an initially acceptable image URL can lead to a different host or potentially an internal network destination. The DOM filter checks whether an image URL contains the substring `mmbiz`, but substring matching is not e ...[truncated 2206 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger example “帮我存” is generic everyday speech and is not specific to WeChat article clipping or Obsidian. In a markdown skill description, this kind of broad phrase can overlap with unrelated user requests and increase the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.