Wechat Article Extractor Skill

• Outcome: Review
• Latest audit: Jul 9, 2026 · 7:45 PM UTC
• Version: 1.0.2

Overview

This deprecated WeChat article extractor mostly matches its stated purpose, but it needs review because its core parser executes JavaScript taken from fetched or user-provided HTML and it ships insecure/debug helper scripts.

Install only if you are comfortable running a deprecated extractor in an isolated workspace. Avoid feeding it arbitrary HTML, avoid running the bundled helper scripts, and prefer a maintained replacement after reviewing its permissions. If keeping this skill, remove dynamic JavaScript execution, restore verified TLS, make file outputs explicit and user-chosen, and update abandoned dependencies.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill advertises network, file read, and file write capabilities through examples and described behavior, but does not declare permissions. This creates a transparency and policy-enforcement gap: a host or reviewer may underestimate what the skill can access, especially because the document also redirects users to a larger replacement package.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The file presents the skill as deprecated and effectively a redirect, yet the documented behavior still describes active extraction, remote fetching, transfer-link following, and local output generation. This mismatch is dangerous because users may trust it as inert or low-risk while it still performs data retrieval and file-producing actions, and the redirect to a mega-package increases supply-chain and over-installation risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The README presents the project as installable and maintained even though the skill metadata explicitly marks it as deprecated and no longer maintained. This can mislead users into installing an unsupported component, increasing the chance of relying on stale code, broken behavior, or unpatched security issues.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code explicitly disables TLS certificate validation and hostname checking before fetching remote content. This enables man-in-the-middle interception or content tampering, allowing an attacker on the network path to supply malicious or falsified HTML that the tool will trust and persist locally.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script uses hard-coded absolute paths to read input and write output inside a user-specific workspace without validation or user consent. This is dangerous because it can expose local filesystem structure, overwrite existing files, and encourage unsafe assumptions about execution context, especially in agent environments where file access should be explicit and constrained.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The script persists extracted article HTML to disk, which goes beyond a minimal in-memory extraction flow and creates an additional data-handling side effect. Writing untrusted remote HTML to a local file can expose sensitive scraped content to other local processes/users, leave residual data unexpectedly, and increase the chance that the file is later opened/rendered unsafely.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code writes extracted content to a hard-coded, user-specific absolute path, which is risky because it performs filesystem modification without caller control and assumes a particular host environment. In an agent skill context, this is more dangerous because the skill description suggests extraction, not persistent writes, so the behavior is unexpected and could overwrite files, leak scraped data into a predictable location, or fail in unsafe ways on another system.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The extractor fetches remote HTML and then reconstructs and executes script-derived code with the Function constructor. Even though the code attempts to sandbox values into local objects, this still creates an interpreter for untrusted page content, which is unnecessary for article extraction and can enable arbitrary code execution, denial of service, or parser breakout if the assumptions about script shape are violated.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: These branches repeatedly evaluate HTML-derived JavaScript lines to recover fields such as biz, sn, mid, idx, and account metadata. Because the inputs come from remote pages, the code grants those pages execution capability inside the Node.js process, which exceeds the skill's purpose and materially expands attack surface.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The post/repost handler concatenates large portions of page script into a synthesized program and executes it with Function. This is effectively running remote page logic in-process; a crafted page can abuse this behavior to execute attacker-controlled code or cause resource exhaustion, especially since the skill accepts URL input and fetches remote content automatically.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The fallback biz extraction still evaluates a matched HTML line as JavaScript, preserving a code-execution path even when primary parsing changes fail. Although narrower than the larger script execution paths, it remains unsafe because attacker-controlled markup can influence the evaluated line.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script silently writes fetched remote content to a hard-coded local path under a user profile without prompting or disclosure. In a skill/package context, unannounced persistence of network-derived data can expose sensitive content locally, overwrite existing files, or create forensic/privacy risks, especially because the destination is not user-controlled at runtime.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: TLS certificate verification and hostname checking are explicitly disabled, which allows a man-in-the-middle attacker to intercept or modify the supposedly secure HTTPS response. In this skill, the fetched HTML is then saved locally and partially processed, so tampered content could mislead downstream tooling, poison local artifacts, or enable follow-on attacks if the saved HTML is later opened or parsed elsewhere.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code writes extracted article contents to disk automatically with no disclosure, confirmation, or retention controls. Parsed articles may contain sensitive or copyrighted content, so silent persistence increases privacy, compliance, and data handling risk if users expect transient processing only.

Known Vulnerable Dependency: qs==6.15.0 — 1 advisory(ies): CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u)

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The package depends on qs 6.15.0, which is flagged for a remotely triggerable denial-of-service condition in qs.stringify when given null/undefined in affected paths. In an article-extraction skill that likely processes remote input and query parameters, this could allow crafted input to crash requests or disrupt service availability if the vulnerable code path is reachable.

Known Vulnerable Dependency: request==2.88.2 — 1 advisory(ies): CVE-2023-28155 (Server-Side Request Forgery in Request)

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: request 2.88.2 has a known SSRF vulnerability, and this skill appears to be a network-facing content fetcher/extractor, making unsafe URL fetching particularly relevant. If attacker-controlled article URLs, redirects, or request options are accepted, the dependency could be abused to reach internal services, metadata endpoints, or other restricted network resources.

Abandoned Dependency: request is unmaintained and no longer receives security updates

Medium

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The request library is abandoned and no longer receives security fixes, which materially increases long-term exposure to newly discovered flaws. In a deprecated skill that fetches external content, relying on an unmaintained HTTP client is more dangerous because there is little expectation of future patching while the attack surface remains network-facing.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/extract.js:206

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: check_content.py:9

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: check_content2.py:9