Wechat Blog Write Publish

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:52 AM UTC
• Version: 1.0.0

Overview

The skill matches its WeChat article workflow, but it needs Review because it can send unpublished content to WeChat, use account publishing credentials, and install an unpinned global CLI.

Review before installing. Use this only for content you are willing to send to WeChat, confirm manually before any publish command, avoid pasting real AppSecrets into chat or command history, prefer a pinned/local CLI installation, and rotate any WeChat secret that may already have been entered into a logged command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:82

Finding

Unpinned Global Installation of a Third-Party CLI in Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:82
Vulnerability Type: Unpinned globally installed dependency
Risk Level: Medium

Complete Code Snippet:

bash

npm install -g @wenyan-md/cli

Technical Analysis

The skill instructs users or agents to install @wenyan-md/cli globally without specifying an exact version or verifying package integrity. Consequently, the installed implementation depends on whichever release the npm registry resolves at execution time, rather than the version reviewed when this skill was published.

A global npm installation may execute package lifecycle scripts and makes the resulting executable available system-wide for the current environment. This does not prove that the named package is malicious, but it creates a mutable supply-chain trust boundary: compromise of the package, maintainer account, registry distribution path, or a future release could introduce code that is not represented in the audited project.

Attack Path

1. An attacker compromises the package publication process or publishes a malicious future release.
2. A user or agent follows the skill instruction after that release becomes current.
3. npm resolves and globally installs the compromised version.
4. Malicious lifecycle code can execute during installation, or malicious CLI code can execute when wenyan is invoked.
5. The code can act with the privileges of the user running npm and potentially access local article files, environment data, and WeChat credentials available to that account.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. The affected scope may include files readable or writable by that user, publishing credentials accessible in the environment or CLI configuration, generated content, and the integrity of subsequent publishing operations. Administrative privileges are not inherently obtained unless the in ...[truncated 50 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a reviewed exact version, such as @wenyan-md/cli@X.Y.Z.
• Prefer a project-local, lockfile-controlled installation over a global installation.
• Commit and review the relevant lockfile, and use deterministic installation commands such as npm ci.
• Verify npm provenance, publisher identity, release signatures where supported, and expected package integrity before installation.
• Disable or separately review lifecycle scripts when operationally feasible.
• Run the publishing tool in a restricted environment with access only to the required article assets and credentials.
• Establish an explicit dependency-update review process before changing the pinned version.

T08 · Insecure Dependencies

Warning

• Location: README.md:47

Finding

Unpinned Global Installation Repeated in User Documentation

Content

View full analysis

Vulnerability Details

File Location: README.md:47
Vulnerability Type: Unpinned globally installed dependency
Risk Level: Medium

Complete Code Snippet:

bash

npm install -g @wenyan-md/cli

Technical Analysis

The README independently directs users to install the latest registry-resolved version of a third-party npm CLI globally. No exact version, lockfile, checksum, or provenance verification is provided. The installed code can therefore change after this project has been reviewed.

Global installation increases exposure because npm lifecycle code may run during installation and the installed executable becomes broadly available in the user's environment. The finding represents supply-chain risk; the audit found no evidence that the currently named package is itself malicious.

Attack Path

1. A malicious or compromised release is published under the referenced package name.
2. A user executes the documented installation command.
3. npm downloads the current compromised release without enforcing a reviewed version.
4. Package lifecycle scripts or later wenyan invocations execute attacker-controlled code.
5. The code operates under the invoking user's account and may target local content or credentials.

Impact Assessment

Exploitation could result in code execution with the invoking user's permissions, theft or modification of readable files, exposure of locally available publishing credentials, and unauthorized manipulation of WeChat publishing activity. System-wide administrative control would require the user to run npm with elevated privileges and is not implied by the instruction itself.

Remediation

View remediation

Remediation Suggestions

• Replace the command with an exact, security-reviewed package version.
• Use a local development dependency and a committed lockfile rather than global installation.
• Document package provenance and integrity-verification procedures.
• Review dependency changes before updating the pinned version.
• Avoid elevated installation privileges and isolate publishing operations from unrelated files and secrets.
• Keep README instructions synchronized with the hardened instructions in SKILL.md.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:99

Finding

WeChat AppSecret Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:99
Vulnerability Type: Sensitive credential passed in a process argument
Risk Level: Medium

Complete Code Snippet:

bash

wenyan config --appid YOUR_APP_ID --appsecret YOUR_APP_SECRET

The source uses localized placeholders for YOUR_APP_ID and YOUR_APP_SECRET; they are rendered in English above without changing the command's security semantics.

Technical Analysis

The instruction places the WeChat AppSecret directly on the command line. Command-line secrets can be retained in shell history, terminal transcripts, command auditing systems, CI/CD logs, support recordings, or process metadata. Depending on the operating system and process-inspection policy, another local user may also be able to observe the argument while the command is running.

The command uses placeholders rather than a hardcoded real credential, so no credential is embedded in the repository. The vulnerability arises when a user substitutes an actual secret and executes the documented command.

Attack Path

1. A user replaces the placeholder with a valid WeChat AppSecret.
2. The shell records the resulting command, or an automation/logging system captures it.
3. A local user, log reader, support operator, or compromised process retrieves the plaintext secret.
4. The attacker combines it with the corresponding AppID and satisfies applicable WeChat controls, including IP allowlisting where required.
5. The attacker uses the credentials to request API access and perform operations authorized for that official account.

Impact Assessment

Exposure compromises the confidentiality of the WeChat application credential. Subject to platform permissions and controls, an attacker may obtain API access associated with the account, interfere with publishing workflows, access API-visible account data, or submit unauthorized content. The credential does not directly grant operating-s ...[truncated 105 chars]

Remediation

View remediation

Remediation Suggestions

• Configure the secret through an interactive hidden prompt that does not echo or persist input.
• Alternatively, retrieve it from an operating-system keychain or approved secret manager.
• Avoid placing secrets in command arguments, shell history, source files, or ordinary environment files.
• If the CLI only supports command-line secrets, change the CLI to accept the secret through protected standard input or a restrictive file descriptor.
• Ensure any credential configuration file is permission-restricted and excluded from version control and backups where appropriate.
• Document safe secret rotation and immediately rotate any credential previously entered into a logged command.
• Apply least-privilege API permissions and retain the WeChat IP allowlist as defense in depth.

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:64

Finding

Command-Line AppSecret Exposure Repeated in User Documentation

Content

View full analysis

Vulnerability Details

File Location: README.md:64
Vulnerability Type: Sensitive credential passed in a process argument
Risk Level: Medium

Complete Code Snippet:

bash

wenyan config --appid YOUR_APP_ID --appsecret YOUR_APP_SECRET

The source uses localized placeholders for YOUR_APP_ID and YOUR_APP_SECRET; they are rendered in English above without changing the command's security semantics.

Technical Analysis

The README advises users to substitute an actual WeChat AppSecret into a command-line argument. Although the repository contains no real secret, the resulting command can expose one through shell history, process listings, terminal capture, CI logs, or system command auditing.

Because documentation is likely to be copied directly, this pattern can repeatedly create durable plaintext copies of a long-lived credential on user systems.

Attack Path

1. The user substitutes valid account credentials into the documented command.
2. The command is saved in history or captured by process or automation logging.
3. An unauthorized party with access to that record obtains the AppSecret.
4. The party uses the associated AppID and attempts to authenticate to WeChat from an allowed network location.
5. Any API capabilities assigned to those credentials may be exercised without authorization.

Impact Assessment

The primary impact is disclosure of a WeChat API credential. Potential consequences include unauthorized API authentication, manipulation of account publishing operations, and access to data or functions available to the application. The precise scope depends on WeChat permissions, IP allowlisting, and other platform-side restrictions. This issue does not by itself provide local privilege escalation.

Remediation

View remediation

Remediation Suggestions

• Replace the documented argument-based flow with an interactive, non-echoing secret prompt.
• Integrate with a protected keychain or secret manager where possible.
• Prevent secrets from being written to shell history, terminal logs, CI output, and source-controlled configuration.
• Store required local configuration with least-privilege filesystem permissions.
• Add credential rotation guidance for users who have already followed the existing command.
• Keep IP allowlisting and narrowly scoped API permissions enabled as secondary controls.
• Update both README.md and SKILL.md so users are not directed back to the insecure configuration method.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly promotes one-click publication to the WeChat draft box but does not clearly warn that article content, metadata, images, and account-linked publication data will be transmitted to external WeChat services. In an agent setting, this can cause users to unintentionally exfiltrate sensitive or unpublished material because the publication step is framed as a normal part of the workflow rather than a high-friction external action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to publish generated content directly to a WeChat draft box, which sends article content and metadata to an external third-party platform and creates persistent side effects. It does not clearly warn users that invoking the skill may transmit source-derived content externally or create a draft in their公众号 account, so users may trigger publication without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells users to obtain and configure AppID and AppSecret for the WeChat account but provides no guidance on treating these as sensitive secrets. This increases the risk that credentials are exposed in prompts, logs, shell history, screenshots, or stored insecurely by the agent environment, which could enable unauthorized access to publishing capabilities.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.