公众号文章批量导出 · WeChat Article Export — 历史文章存为本地 Markdown 知识库

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 8:59 AM UTC
• Version: 1.0.2

Overview

This skill does what it claims: it uses a local browser relay and the user's logged-in WeChat session to export the user's own public-account articles to local Markdown files.

Install this only if you intend to let the skill access the currently logged-in WeChat public-account backend through webclaw3. Confirm the browser is logged into the correct account, use a dedicated output directory, and understand that article content and metadata will be saved locally.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill explicitly instructs the user to run Node.js commands and describes browser-backed access to a logged-in WeChat backend, which implies shell execution and networked access to authenticated content. Because the manifest declares no tool scope or allowed-tools boundary, an agent may be granted broader capabilities than the skill text suggests, increasing the risk of unintended command execution or data access if the implementation or downstream dependency behaves unsafely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill sends browser control and page-extraction commands to an unauthenticated local HTTP relay at 127.0.0.1:3459, including navigation and DOM extraction operations over plain local HTTP. While localhost reduces remote exposure, this still creates a trust boundary issue: any compromised or unexpected local relay implementation could observe browsing targets, extracted content, and browser actions without the user being clearly informed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill writes extracted article bodies and metadata to local disk automatically, but this file provides no inline consent gate, confirmation, or path safety checks before persisting potentially sensitive content. Because the content comes from a logged-in private admin context and the output path is user-controlled, this can lead to unintended local data exposure or overwriting of files in unexpected locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code enumerates existing browser tabs and extracts a WeChat admin token from any matching logged-in mp.weixin.qq.com URL, then reuses that authenticated session to access publication records. This is a sensitive session-harvesting behavior: even if intended for convenience, it accesses privileged browser state without an explicit authorization step in the code, which can expose private account data if invoked unexpectedly or by another workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file clearly describes saving公众号 articles as local Markdown, and later specifies concrete output paths and files. However, it does not include an explicit user-facing warning or caution about local file creation/overwrite implications, which is relevant because the skill affects user data on disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.