Pixmind WeChat Creator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:02 AM UTC
• Version: 0.3.6

Overview

The skill mostly matches its WeChat article workflow, but its fallback CLI can send a Pixmind bearer token and article materials to an arbitrary API host from the environment.

Use the Pixmind Builder transport when possible. If using the fallback CLI, only run it in a trusted environment, do not set PIXMIND_API_BASE_URL unless you fully trust that endpoint, and understand that article topics, source URLs, selected material-file contents, and generated project data are uploaded to Pixmind and may consume credits.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wechat-creator.js:6

Finding

Configurable API Origin Can Exfiltrate the Bearer Token and User Article Materials

Content

View full analysis

({})); if (!response.ok || body.code !== 1000) { const error = new Error(body.message || `Pixmind API request failed (${response.status})`); error.code = body.code || `HTTP_${response.status}`; error.status = response.status; throw error; } return body.data; } ``` The CLI reads the API key and optional local material, then transmits the material in the project brief: ```js const apiKey = process.env.PIXMIND_API_KEY; if (!apiKey) throw Object.assign(new Error('This external-host CLI requires PIXMIND_API_KEY in its process environment. In Pixmind Builder, use pixmind_api_request with the key saved under Settings → Providers → Pixmind instead of running this script.'), { code: 'MISSING_API_KEY' }); if (!options.projectId && !options.topic) throw new Error('--topic or --project-id is required'); const requestId = String(options.requestId || `wechat-${randomUUID()}`); const materials = options.materialFile ? [await readFile(options.materialFile, 'utf8')] : []; let project = options.projectId ? await request(`/api-platform/v1/content/projects/${encodeURIComponent(options.projectId)}`, ...[truncated 3181 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/public-safety-rules.md (reported line 13)May include surrounding context.

md

- Do not claim that an article is factually verified merely because review status is `passed`.
- Sanitize remote HTML before previewing or copying it.
- `copy.rich-text` only writes to the local clipboard. The user remains responsible for reviewing and publishing in the WeChat editor.
- This Skill never asks for AppID, AppSecret, access tokens, account aliases, or WeChat publication permissions.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill references capabilities that can reach networked services and, in fallback mode, access environment-based credentials, but it does not declare an explicit tool scope or allowed-tools boundary. That increases the chance of overbroad tool access, accidental invocation of unintended tools, or secret-handling mistakes on hosts that enforce permissions through manifest metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

When no --language argument is provided, the script unconditionally sets the generated content language to 'zh-CN'. This imposes a specific locale by default rather than offering a neutral default or explicit user choice, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest description uses Chinese-specific product terminology and Chinese trigger examples for WeChat Official Account workflows, which can act as a locale/language constraint in natural-language behavior. While the workflow later collects a language preference, the top-level invocation description does not present language choice or opt-in, so this is a mild language/locale policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This JSON manifest description broadly states the skill can complete topic selection, outlining, writing, review, image matching, and formatting, but it does not define specific invocation phrases, activation boundaries, or exclusions. In a manifest file, this ambiguity can make it unclear when the skill should activate versus when general writing requests should not invoke it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown includes a UI label string, "复制到公众号编辑器", that forces a specific language in the presented action. The file does not indicate that the skill is region-specific or that users can opt into this locale, which creates a natural-language policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/wechat-creator.js:6