微信创作

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:23 PM UTC
• Version: 1.0.0

Overview

This appears to be a WeChat draft-publishing helper with expected credentialed API use, but users should treat it as an account-connected publishing tool rather than a purely local formatter.

Install only if you intend to let the skill use your WeChat Official Account credentials to create drafts and, if enabled, use an AI image-generation API key. Keep credentials in environment variables, use a trusted HTTPS AI endpoint, review drafts before publication, and prefer pinned patched dependency versions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tainted flow: 'url' from os.getenv (line 113, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

"response_format": "b64_json"
    }

    response = requests.post(url, headers=headers, json=payload, timeout=120)
    response.raise_for_status()

    data = response.json()

• Confidence: 94% confidence
• Finding: The request destination is derived from a configurable base URL that can come from an environment variable or caller input, and the code sends the bearer API key to that endpoint. If an attacker can influence configuration, this becomes SSRF plus credential exfiltration to an attacker-controlled host.

Tainted flow: 'url' from os.getenv (line 113, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

"response_format": "url"
    }

    response = requests.post(url, headers=headers, json=payload, timeout=120)
    response.raise_for_status()

    data = response.json()

• Confidence: 95% confidence
• Finding: This path has the same risk as the other AI generation function: it posts to a URL built from configurable input and includes the API key in the Authorization header. A malicious base_url would receive both prompt contents and credentials, enabling secret theft and misuse of the API key.

Tainted flow: 'image_url' from requests.post (line 130, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

data = response.json()
    image_url = data["data"][0]["url"]

    image_response = requests.get(image_url, timeout=60)
    image_response.raise_for_status()

    os.makedirs(os.path.dirname(output_path) if os.path.dirname(output_path) else ".", exist_ok=True)

• Confidence: 91% confidence
• Finding: The code blindly fetches a URL returned by a remote API and writes the response to disk without validating the URL's host, scheme, content type, or size. If the upstream service or response is compromised, this can trigger SSRF-like outbound access, download unexpected content, or save malicious/non-image data locally.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly automates publishing content to a WeChat public account draft box using configured AppID and Secret, but the documentation does not clearly warn users that running it will perform authenticated actions against their account. This can lead to unintended external actions, misuse of privileged credentials, and surprise publication-side effects, especially when users treat the skill as a local formatting tool rather than an account-integrated publisher.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
markdown2>=2.4.0
Pillow>=9.0.0

• Confidence: 97% confidence
• Finding: The dependency specification uses a lower-bound constraint only, which allows installation of any newer version, including versions with breaking changes or newly introduced vulnerabilities. This weakens build reproducibility and supply-chain control, especially because the same file also references packages with known advisories.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
markdown2>=2.4.0
Pillow>=9.0.0

• Confidence: 97% confidence
• Finding: The markdown2 package is unpinned, so deployments may resolve to different versions over time, including vulnerable or incompatible releases. This is particularly risky for a package with a history of XSS and ReDoS advisories when used to process untrusted content.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.28.0
markdown2>=2.4.0
Pillow>=9.0.0

• Confidence: 98% confidence
• Finding: Pillow is specified with only a minimum version, allowing resolution to a wide range of versions and reducing assurance that installations avoid vulnerable builds. Given Pillow's history of serious image parsing issues, including resource-consumption and possible code-execution class flaws, this increases supply-chain and runtime risk if untrusted images are handled.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The requirement permits installation of requests versions affected by multiple published advisories because it only enforces requests>=2.28.0. If dependency resolution selects a vulnerable release, issues such as credential leakage or TLS/verification problems could expose secrets or weaken outbound request security.

Known Vulnerable Dependency: markdown2 — 8 advisory(ies): CVE-2009-3724 (Cross-site scripting in markdown2 for python); CVE-2020-11888 (XSS in python-markdown2); CVE-2021-26813 (markdown2 Regular Expression Denial of Service ) +5 more

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The markdown2 dependency is associated with several known vulnerabilities, and the loose version constraint does not demonstrate that a fixed version is required. In any skill that renders or transforms untrusted markdown, this can lead to XSS or denial-of-service conditions, making the context meaningfully dangerous.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: Pillow has numerous published security advisories, including serious image-decoding flaws, and the requirement does not ensure a patched version is installed. If the skill accepts or processes attacker-controlled images, exploitation could cause denial of service, memory corruption, or potentially code execution depending on the vulnerable version and code path.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.