Wechat Image Generator

• Outcome: Review
• Latest audit: Jul 9, 2026 · 7:45 PM UTC
• Version: 1.0.4

Overview

This skill is a disclosed WeChat image generator, but one screenshot helper uses an unsafe shell command that can turn a crafted file path into command execution.

Install only if you are comfortable reviewing or avoiding scripts/auto_screenshot.py. Prefer running scripts/generate.py with trusted output paths and manually screenshotting the generated HTML, or patch the helper to call browser with argument lists and restrict inputs to local HTML files before using it in automated workflows.

SkillSpector

Vulnerability Patterns

• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Open in browser
    open_cmd = f'browser open --url "{file_url}"'
    result = subprocess.run(open_cmd, shell=True, capture_output=True, text=True)
    
    if result.returncode != 0:
        print(f"❌ Failed to open browser: {result.stderr}")

• Confidence: 98% confidence
• Finding: This command is built as a shell string and executed with shell=True while embedding a user-controlled path-derived URL. An attacker can supply a crafted html_path containing shell metacharacters or command-substitution syntax so the shell executes unintended commands, leading to arbitrary command execution in the context of the script.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill advertises executable usage that reads inputs, writes output files, and invokes shell-style commands, yet it declares no permissions or capability boundaries. This weakens user and platform visibility into what the skill can do and can lead to over-trusting a package that performs filesystem and command execution operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The metadata and description emphasize that the skill is deprecated and redirect users elsewhere, while the documented behavior still describes active local generation, browser invocation, and screenshot workflow. This mismatch can mislead reviewers and users about the operational surface area, causing risky code paths to receive less scrutiny than an actively maintained tool would.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script passes a user-controlled file path into a shell-executed browser command without meaningful validation or an explicit warning about the security boundary. Because the path is incorporated into a quoted shell string, crafted input can break out of quoting or trigger shell expansion, causing command injection.

Unvalidated Output Injection

High

• Category: Output Handling

Content

# Open in browser
    open_cmd = f'browser open --url "{file_url}"'
    result = subprocess.run(open_cmd, shell=True, capture_output=True, text=True)
    
    if result.returncode != 0:
        print(f"❌ Failed to open browser: {result.stderr}")

• Confidence: 98% confidence
• Finding: The shell command incorporates untrusted path data into a browser-open invocation, creating an output/command injection path through the shell boundary. In an agent skill context, this is especially dangerous because upstream inputs may come from other tools, workflow steps, or users and may be trusted implicitly.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Open in browser
    open_cmd = f'browser open --url "{file_url}"'
    result = subprocess.run(open_cmd, shell=True, capture_output=True, text=True)
    
    if result.returncode != 0:
        print(f"❌ Failed to open browser: {result.stderr}")

• Confidence: 96% confidence
• Finding: The script forwards attacker-influenced data into a powerful external tool invocation through the shell. That enables parameter abuse and command execution beyond the intended browser action, which could expose local files, run arbitrary commands, or manipulate the host environment.

Static analysis

No suspicious patterns detected.