Security audit

微信公众号文章处理器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward WeChat-article-to-Feishu workflow, with expected external storage behavior disclosed in its instructions and no evidence of hidden execution, persistence, credential theft, or destructive actions.

Install only if you want WeChat article content processed and saved into Feishu. Do not use it on private, access-controlled, copyrighted, or sensitive articles unless you are comfortable with that content being sent to and stored in Feishu, and confirm Feishu permissions before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises an end-to-end微信公众号文章处理工具 that can automatically grab article content, structure it, and save it to Feishu. However, the supplied code chunk contains only helper functions for extracting content from an already obtained browser output string and formatting that content as Markdown. The main function merely reads a URL argument and instructs the user to use a browser tool manually. There is no network fetching logic, no browser automation, no Feishu API integration, and no persistence step. While the structuring/formatting portion aligns partially with the description, the major advertised capabilities are absent, so this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The trigger phrases are broad enough that the skill may activate on loosely related user input without clear consent or narrowing conditions. In this context, unintended activation matters because the workflow is designed to fetch third-party content and send processed article data into Feishu, potentially causing unanticipated data handling or storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow states that article content will be saved to a Feishu document, but it does not clearly warn users that fetched third-party content and derived summaries will be transmitted to and stored in an external service. That lack of transparency creates privacy and data-governance risk, especially if users paste links containing sensitive or access-controlled content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Automatically triggering on any WeChat public-account link is risky because it removes an explicit user confirmation step before retrieving content and potentially transferring it to Feishu. This can lead to accidental processing of sensitive, private, or copyrighted material and increases the chance of external data transmission the user did not clearly intend.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring, usage instructions, and runtime messages are all written exclusively in Chinese, which imposes a specific language on users. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script's command-line usage and status messages are emitted only in Chinese, which constitutes a language policy concern for a general-purpose skill. There is no mechanism to select another language or indication that the tool is region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.