Security audit

Wechat Articles Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its WeChat article-saving purpose, but it runs a browser against an unchecked URL with the host machine's network access, which needs user review before installation.

Install only if you are comfortable with a skill that launches Chromium and saves fetched article content locally. Use it only with trusted https://mp.weixin.qq.com links, run it in an isolated environment if possible, specify an output directory, and prefer pinned dependency versions before installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_article.py:129
Finding: Unrestricted Browser Navigation Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:10
Finding: Unpinned Third-Party Dependencies and Browser Artifacts
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README describes the skill entirely in Chinese and specifies behavior around fetching WeChat public-account articles, implying a fixed language/locale context without offering any user choice or opt-in. Under the policy, language or locale constraints should be explicit and justified or presented as optional to the user.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill performs local file writes by saving fetched article content and images, but it does not declare any tool scope or permissions boundary. This weakens reviewability and increases the chance that an agent invokes file-writing behavior without clear policy constraints or user awareness, especially if output paths or filenames are influenced by external content.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The --no-images flag and related parameter names/documentation imply that the script normally downloads article images. In reality, html_to_markdown only preserves image URLs in Markdown placeholders and save_article merely creates an images directory; there is no network or file logic that fetches image bytes, so the documentation/CLI intent contradicts actual behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The README states that the agent will automatically save the fetched article as a local file, but it does not clearly warn users that local filesystem writes will occur or where files will be created. In an agent environment, implicit file creation can surprise users, clutter the workspace, or overwrite existing content if paths are not made explicit elsewhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill description explains that it fetches and converts articles, but it does not prominently warn that it will persist downloaded text and images to local storage. This can surprise users and lead to unintended retention of untrusted remote content on disk, which is a meaningful safety and privacy issue even if the behavior is expected by the implementation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code creates the output directory, may create an images subdirectory, and writes a Markdown file to disk. Although it prints the saved path after completion, there is no prior disclosure in comments, docstrings, or argument help that running the script will modify the local filesystem.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.