Security audit

Rss To Wechat

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent RSS-to-WeChat purpose, but it deliberately bypasses safer URL-fetching boundaries and includes automatic publishing paths that need careful review before use.

Install only if you are comfortable running shell scripts that fetch arbitrary URLs from your machine and may upload generated drafts to WeChat when configured. Use throwaway or least-privilege WeChat credentials, keep config.local.sh private, avoid unattended daily-featured automation until an approval gate is added, and do not process untrusted URLs unless URL validation and SSRF protections are added.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/parse-article.sh:44
Finding: Unrestricted URL Fetching Deliberately Bypasses SSRF Protections
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: references/html-template.md:17
Finding: Hardcoded Branding Overrides the Documented User-Configurable Output
Content: View full analysis
AI晚知道
"All the AI News That's Fit to Read"
``` The executable formatter repeats the same fixed branding in `scripts/format-wechat.sh`: ```html AI晚知道

"All the AI News That's Fit to Read"
``` Meanwhile, `SKILL.md` instructs the agent to use the template: ```markdown 2. **HTML 生成**（AI 辅助） - AI 助手生成微信兼容的 HTML - 使用品牌配置 - 遵循严格的格式要求（见 `references/html-template.md`） ``` ### Technical Analysis The Skill claims that branding is configurable through values such as `BRAND_NAME` and `BRAND_SLOGAN`. However, the canonical AI-facing template and the executable formatter contain fixed brand text instead of configuration placeholders. An agent following the Skill's instructions can therefore reproduce the embedded branding in generated articles even when the user configured a different brand. The direct formatter has the same behavior. This creates deterministic, persistent modification of user-facing output that is unrelated to the source article. The issue affects both instruction-driven generation and script-driven generation. It is not merely a harmless default because the fixed strings are not replaced by the documented configuration values. ### Attack Path 1. A user loads the Skill to convert an ar ...[truncated 847 chars]
Remediation: View remediation
{{BRAND_NAME}}
{{BRAND_SLOGAN}}
``` 2. Modify `scripts/format-wechat.sh` to HTML-escape and use `BRAND_NAME` and `BRAND_SLOGAN`. 3. Make branding opt-in where possible and omit it when the user has not configured a value. 4. Ensure the AI-facing template clearly instructs the agent not to invent, preserve, or promote a default brand. 5. Add automated tests verifying that customized branding appears and the fixed strings do not. 6. Keep the executable formatter and reference template synchronized. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/format-wechat.sh:37
Finding: Untrusted Article Data Is Written to HTML Without Robust Sanitization
Content: View full analysis
$TITLE
来源：$AUTHOR | 发布时间：$PUBLISHED
``` The body is processed with regular-expression substitutions rather than an HTML sanitizer: ```bash echo "$CONTENT_HTML" | sed \ -e 's|]*>|
|g' \ -e 's||
|g' \ -e 's|]*>|
|g' \ -e 's||
|g' \ -e 's|]*>|
|g' \ -e 's||
|g' \ -e 's|]*>|
|g' \ -e 's|
|
|g' \ -e 's|
||g' \ -e 's|||g' \ -e 's|||g' \ -e 's|
text
|
|g' \ -e ...[truncated 2979 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/USER_GUIDE.md:24
Finding: Documentation Installs an Unpinned Global npm Dependency
Content: View full analysis
Remediation: View remediation
``` 2. Use a project-local dependency rather than a global installation. 3. Commit and verify a lockfile with integrity hashes. 4. Document the expected package publisher, registry, and provenance. 5. Use npm provenance and signature verification where supported. 6. Consider installation with lifecycle scripts disabled: ```bash npm install --ignore-scripts ``` Enable scripts only after reviewing whether the package requires them. 7. Run the dependency with least privilege in an isolated environment. 8. Establish a dependency update and security-review process before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (32)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims a narrowly framed formatting/publishing purpose, but the documented workflow accepts arbitrary URLs and performs remote content fetching and parsing. In this context, broader web retrieval capability is more dangerous because it can enable unexpected network access, ingestion of untrusted content, and potentially SSRF-like abuse if downstream scripts are insufficiently constrained.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims a narrowly framed formatting/publishing purpose, but the documented workflow accepts arbitrary URLs and performs remote content fetching and parsing. In this context, broader web retrieval capability is more dangerous because it can enable unexpected network access, ingestion of untrusted content, and potentially SSRF-like abuse if downstream scripts are insufficiently constrained.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims a narrowly framed formatting/publishing purpose, but the documented workflow accepts arbitrary URLs and performs remote content fetching and parsing. In this context, broader web retrieval capability is more dangerous because it can enable unexpected network access, ingestion of untrusted content, and potentially SSRF-like abuse if downstream scripts are insufficiently constrained.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README advertises optional automated publishing to a WeChat account but does not prominently warn that article content and account credentials may be transmitted to external services. This can lead users to enable publishing without understanding data-flow, credential sensitivity, or the consequences of sending drafts and metadata to third-party APIs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README says the assistant will automatically recognize and load the skill based on broad keywords, which creates scope ambiguity for activation. In an agent environment, generic auto-loading can cause the skill to run in conversations where the user did not intend content fetching or publishing behavior, increasing the risk of unintended external actions or prompt-surface expansion.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The listed triggers include generic phrases like "WeChat format" and "get article from RSS," which are likely to collide with ordinary user requests unrelated to this specific skill. In an auto-activation framework, such collisions can unexpectedly invoke parsing, content transformation, or publishing workflows and expose users to unintended external operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README instructs users to place WeChat AppID and AppSecret into a local config file without prominent guidance on credential sensitivity, storage hygiene, or exclusion from version control. This increases the risk of accidental secret exposure through commits, backups, logs, or shared environments, especially for users following setup steps verbatim.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README advertises optional automatic publishing to WeChat drafts using API credentials, but it does not clearly warn that content and metadata will be transmitted to an external third-party service. In an agent skill context, this omission can cause users to enable publishing without fully understanding that private, copyrighted, or sensitive article content may be uploaded outside their local environment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: An overly broad auto-activation trigger such as requests about publishing articles to a public account can cause the skill to activate in situations the user did not specifically intend. In an agent ecosystem, this raises the chance of unexpected processing, content transformation, or even downstream publication actions being initiated based on ambiguous prompts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill advertises shell-based usage (bash scripts/...) but does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization and transparency gap: an agent may execute shell commands beyond what a reviewer expects, especially since the skill also references networked fetching and publishing workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill mentions optional publishing via configured WeChat credentials, but it does not prominently warn that article content and credentials may be used in network API operations. This omission reduces informed consent and may cause operators to expose sensitive content or trigger publication actions without fully understanding the data-flow and external transmission risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file documents optional publishing using WeChat credentials and says drafts are automatically uploaded, but it does not explicitly warn users that article content and associated metadata will be transmitted to external services. Because this behavior can affect user data, privacy, and external account state, a user-facing warning is expected in the skill description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown template is written entirely as a Chinese-language output format, including Chinese labels such as the title, section headings, and content requirements. Because the file does not offer an opt-in language choice or explain that the skill is intentionally region-specific, it appears to impose a specific locale by default.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This script automatically publishes a selected article by invoking publish-article.sh with no interactive confirmation, approval gate, dry-run default, or other explicit safeguard in this code path. In the context of a content-publishing skill, that increases the risk of unintended or incorrect publication if upstream RSS input, filtering logic, or scheduling behaves unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This shell script presents its description, usage text, option help, examples, and runtime messages in Chinese only. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale policy issue unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated date string is forced to Asia/Shanghai and rendered in Chinese weekday text, which imposes a specific locale on all users. This is a natural-language policy concern because the skill does not provide opt-in, configuration, or documentation justifying the locale restriction as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script's user-facing comments, usage text, and status messages are all in Chinese, which imposes a specific language on users. Under the policy, locale or language constraints should either be optional or clearly justified; this file provides no user choice or documented rationale for the language restriction.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script explicitly documents that it uses curl to bypass SSRF protections and then fetches an attacker-controlled URL directly. In an agent skill context, this can be abused to access internal-only services, cloud metadata endpoints, or other network resources that higher-level platform safeguards were intended to block.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This script performs arbitrary outbound fetches against a user-supplied URL with curl, and the adjacent comment makes clear this is meant to evade SSRF restrictions. Because the skill is designed to ingest external articles, the dangerous behavior is directly on the main execution path, increasing the chance that a crafted URL could trigger internal network access or data exfiltration.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script’s natural-language interface is written in Chinese and later forces Asia/Shanghai date formatting, but it does not provide any opt-in, locale selection, or justification that the skill is intentionally region-specific. This is a natural-language locale policy issue because users are required into a specific language/locale experience without choice.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/rss-to-wechat.sh (reported line 97)May include surrounding context.
sh
# 检查必需工具 echo "必需工具:" for cmd in curl jq pandoc; do if command -v "$cmd" &> /dev/null; then echo " ✅ $cmd" else

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: These lines explicitly set TZ=Asia/Shanghai and format dates in Chinese, enforcing a locale-specific output regardless of user preference. The file does not present this as a justified regional constraint or provide an option to choose another locale/timezone.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This shell script presents all user-facing messages in Chinese, including status output and usage examples, with no opt-in, fallback, or explanation that the skill is intended only for Chinese-speaking users. That creates a natural-language locale policy concern because the skill effectively enforces a specific language for interaction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The changelog explicitly says SKILL.md was updated to Chinese and README was changed to prioritize Chinese. This is a natural-language locale policy concern because it signals a default language constraint without indicating user choice or a documented region-specific reason.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Natural-language policy requires avoiding forced language or locale constraints unless users are given a choice or the restriction is clearly justified. This guide presents all operational instructions in Chinese and sets no expectation that the skill is China-specific or Chinese-only.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.