微信公众号发布助手

• Outcome: Review
• Latest audit: Jul 5, 2026 · 4:32 AM UTC
• Version: 2.1.2

Overview

This skill appears to do what it says, but it publishes to WeChat using account credentials and has weak controls around confirmation, token storage, and dependency installation.

Install only if you intend to connect a WeChat Official Account and are comfortable uploading the selected article and images to WeChat. Use dry-run first, avoid --publish until you have reviewed the draft, keep credentials out of config.json where possible, delete or protect .token_cache.json, and install dependencies in an isolated virtual environment with reviewed pinned versions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes capabilities to read local files, write token caches and previews, invoke Python/pip, and communicate with external WeChat services, yet no permissions are explicitly declared. This creates a transparency and least-privilege problem: users or orchestrators may authorize the skill without understanding it can access local content, credentials, and the network.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The top-level description frames the skill as deprecated and redirects users elsewhere, but the body still provides active operational behavior for publishing content, uploading images, caching tokens, and installing dependencies. This mismatch can mislead reviewers and users about what the skill actually does, reducing scrutiny around sensitive actions like external uploads and credential handling.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The skill includes an installation mode that executes `pip install -r requirements.txt`, which is outside the narrow publishing function and can trigger arbitrary code execution through dependency installation hooks or compromised packages. In an agent-skill context, package installation expands the trust boundary from local content publishing to modifying the host runtime.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill processes local Markdown/HTML and images, then uploads them to WeChat CDN and publishing APIs, but it does not prominently warn that local content leaves the user's environment. This omission increases the risk of unintentional disclosure of drafts, proprietary text, embedded secrets, or sensitive images to third-party services.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The default prompt uses a very broad invocation phrase to publish arbitrary Markdown files or URLs to a WeChat Official Account without clear activation constraints, confirmation gates, or scope limits. Because publishing is an external side-effecting action, ambiguous triggering increases the risk of accidental or prompt-injected publication of untrusted content.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script persists the WeChat access token to `.token_cache.json` in the project directory without setting restrictive permissions or clearly warning the user. On shared systems or in checked-in workspaces, this can expose a live API credential that permits further API actions until expiry.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: Invoking `pip install` changes the host Python environment and may execute untrusted package installation code, but the script provides only a flag and no explicit safety warning or confirmation. In an automation or agent setting, that system modification capability is more dangerous because it can be triggered as part of tool execution rather than a separate admin step.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
beautifulsoup4>=4.12.0
markdown>=3.5.0
pyyaml>=6.0.0

• Confidence: 94% confidence
• Finding: requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
beautifulsoup4>=4.12.0
markdown>=3.5.0
pyyaml>=6.0.0
Pillow>=10.0.0

• Confidence: 92% confidence
• Finding: beautifulsoup4>=4.12.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
beautifulsoup4>=4.12.0
markdown>=3.5.0
pyyaml>=6.0.0
Pillow>=10.0.0

• Confidence: 96% confidence
• Finding: markdown>=3.5.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
beautifulsoup4>=4.12.0
markdown>=3.5.0
pyyaml>=6.0.0
Pillow>=10.0.0

• Confidence: 90% confidence
• Finding: pyyaml>=6.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

beautifulsoup4>=4.12.0
markdown>=3.5.0
pyyaml>=6.0.0
Pillow>=10.0.0

• Confidence: 98% confidence
• Finding: Pillow>=10.0.0

Known Vulnerable Dependency: requests==2.31.0 — 3 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func)

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: requests==2.31.0

Known Vulnerable Dependency: markdown==3.5.0 — 2 advisory(ies): CVE-2025-69534 (Python-Markdown has an Uncaught Exception); CVE-2025-69534 (Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like se)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: markdown==3.5.0

Known Vulnerable Dependency: Pillow==10.0.0 — 8 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2023-4863 (libwebp: OOB write in BuildHuffmanTable) +5 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: Pillow==10.0.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.