WeChat MP Plus

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:55 AM UTC
• Version: 1.0.0

Overview

The skill’s WeChat publishing purpose is coherent, but it has enough high-impact account access and weak safeguards that users should review it carefully before installing.

Install only if you trust the publisher and will run it in a controlled environment. Use a non-production WeChat account first, keep AppSecret values out of repositories and shell history, review Markdown image paths before publishing, avoid processing untrusted Markdown, and be careful with draft/menu delete commands because the skill does not require confirmation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

• Location: scripts/md2html.py:8

Finding

Unpinned Dependency Is Automatically Installed at Runtime

Content

View full analysis

Remediation

View remediation

--hash=sha256: ``` 3. Install dependencies during an explicit setup phase with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use an isolated virtual environment instead of `--break-system-packages`. 5. Configure an approved package index and disable unexpected fallback indexes. 6. Generate and retain a lockfile or software bill of materials for dependency review. 7. If the dependency is missing at runtime, terminate with a clear installation instruction rather than modifying the environment automatically. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/publish.py:27

Finding

Markdown Image Paths Can Cause Unauthorized Local File Uploads

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wechat_mp.py:110

Finding

WeChat Access Token Is Stored in a Predictable Plaintext Temporary File

Content

View full analysis

time.time() + 60: return cache["access_token"] except Exception: pass app_id, app_secret = _get_config() url = f"https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={app_id}&secret={app_secret}" data = _http_get(url) if _api_error(data): sys.exit(1) token = data["access_token"] with open(TOKEN_CACHE, "w") as f: json.dump({"access_token": token, "expires_at": time.time() + data.get("expires_in", 7200)}, f) return token ``` ### Technical Analysis The bearer token is stored as plaintext at a fixed filename in the operating system's shared temporary directory. The code does not explicitly create the file with owner-only permissions, verify file ownership, reject symbolic links, or use exclusive and atomic file creation. Actual readability depends partly on operating-system temporary-directory protections and the process umask. However, relying on these external defaults is unsafe for credential material. The predictable path also creates opportunities for local file replacement, symlink attacks, or cache manipulation where platform permissions permit them. The access token is required for WeChat operations, but a shared predictable temporary path is not required for the declared functionality. ### Attack Path 1. A local attacker predicts the cache path, such as `/tmp ...[truncated 967 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/wechat_mp.py:246

Finding

Bearer Token Material Is Disclosed Through Standard Output

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The feature list and quick-start commands describe uploading assets, converting content, and creating drafts on the WeChat platform, but do not warn users that local article content and images are transmitted to an external service. For markdown skill descriptions, operations affecting user data or privacy should be clearly disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown file includes a menu.py delete command as part of quick-start usage, but provides no warning that this operation deletes the current custom menu configuration. For markdown files, user-facing documentation should disclose behaviors that may affect system integrity or configuration state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill requires sensitive WeChat credentials via environment variables or a local secrets file but gives no privacy, storage, or handling guidance. This can lead users to place app secrets in insecure locations, expose them in shell history or repositories, or mishandle them in shared environments, enabling unauthorized access to the WeChat MP account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents destructive operations such as draft deletion and menu deletion but provides no warning, confirmation step, or guidance about irreversible effects. In an automation context, this increases the chance of accidental content loss or disruption of a production WeChat public account through normal user use or scripted invocation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

A markdown-to-HTML converter should not silently acquire and execute external packages at runtime, because that expands its privilege and trust boundary beyond file conversion. In this skill context, the behavior is more dangerous because agent-executed tools may run unattended on user systems or CI hosts, causing unreviewed package installation and environment changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Installing packages without explicit warning or consent is unsafe because users may not expect the tool to alter the environment or contact package infrastructure. In unattended agent/automation contexts this is especially risky, as the installation may occur implicitly with the privileges of the invoking process.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The script executes pip automatically when the markdown package is missing, which introduces an unnecessary code execution and dependency-fetching capability for a simple document conversion tool. This can modify the host environment, pull unpinned code from package indexes, and break system Python installations due to the use of --break-system-packages.

Content

Scanner excerpt · scripts/md2html.py (reported line 13)May include surrounding context.

python

import markdown
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "markdown", "-q", "--break-system-packages"])
    import markdown

THEMES_DIR = os.path.join(os.path.dirname(__file__), "..", "themes")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/menu.py (reported line 12)May include surrounding context.

python

def get_menu():
    """查询当前菜单"""
    token = get_access_token()
    url = f"https://api.weixin.qq.com/cgi-bin/get_current_selfmenu_info?access_token={token}"
    data = _http_get(url)
    if "errcode" in data and data["errcode"] != 0:
        _api_error(data)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/menu.py (reported line 37)May include surrounding context.

python

def get_menu():
    """查询当前菜单"""
    token = get_access_token()
    url = f"https://api.weixin.qq.com/cgi-bin/get_current_selfmenu_info?access_token={token}"
    data = _http_get(url)
    if "errcode" in data and data["errcode"] != 0:
        _api_error(data)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/menu.py (reported line 48)May include surrounding context.

python

def get_menu():
    """查询当前菜单"""
    token = get_access_token()
    url = f"https://api.weixin.qq.com/cgi-bin/get_current_selfmenu_info?access_token={token}"
    data = _http_get(url)
    if "errcode" in data and data["errcode"] != 0:
        _api_error(data)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat_mp.py (reported line 121)May include surrounding context.

python

def get_menu():
    """查询当前菜单"""
    token = get_access_token()
    url = f"https://api.weixin.qq.com/cgi-bin/get_current_selfmenu_info?access_token={token}"
    data = _http_get(url)
    if "errcode" in data and data["errcode"] != 0:
        _api_error(data)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat_mp.py (reported line 136)May include surrounding context.

python

def get_menu():
    """查询当前菜单"""
    token = get_access_token()
    url = f"https://api.weixin.qq.com/cgi-bin/get_current_selfmenu_info?access_token={token}"
    data = _http_get(url)
    if "errcode" in data and data["errcode"] != 0:
        _api_error(data)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat_mp.py (reported line 147)May include surrounding context.

python

def get_menu():
    """查询当前菜单"""
    token = get_access_token()
    url = f"https://api.weixin.qq.com/cgi-bin/get_current_selfmenu_info?access_token={token}"
    data = _http_get(url)
    if "errcode" in data and data["errcode"] != 0:
        _api_error(data)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat_mp.py (reported line 160)May include surrounding context.

python

def get_menu():
    """查询当前菜单"""
    token = get_access_token()
    url = f"https://api.weixin.qq.com/cgi-bin/get_current_selfmenu_info?access_token={token}"
    data = _http_get(url)
    if "errcode" in data and data["errcode"] != 0:
        _api_error(data)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat_mp.py (reported line 183)May include surrounding context.

python

def get_menu():
    """查询当前菜单"""
    token = get_access_token()
    url = f"https://api.weixin.qq.com/cgi-bin/get_current_selfmenu_info?access_token={token}"
    data = _http_get(url)
    if "errcode" in data and data["errcode"] != 0:
        _api_error(data)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat_mp.py (reported line 199)May include surrounding context.

python

def get_menu():
    """查询当前菜单"""
    token = get_access_token()
    url = f"https://api.weixin.qq.com/cgi-bin/get_current_selfmenu_info?access_token={token}"
    data = _http_get(url)
    if "errcode" in data and data["errcode"] != 0:
        _api_error(data)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat_mp.py (reported line 212)May include surrounding context.

python

def get_menu():
    """查询当前菜单"""
    token = get_access_token()
    url = f"https://api.weixin.qq.com/cgi-bin/get_current_selfmenu_info?access_token={token}"
    data = _http_get(url)
    if "errcode" in data and data["errcode"] != 0:
        _api_error(data)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The delete_menu function issues a live API request to remove the current WeChat menu, which is a destructive operation affecting system state. There is no confirmation prompt, cautionary message, or other user-facing disclosure before deletion occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language strings and docstrings that force a specific language/locale for users. Under the policy, language restriction is a violation unless the skill offers user opt-in or clearly documents a justified region-specific constraint, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The docstring for _get_config says it gets AppID and AppSecret 'from environment variables or configuration file', but the implementation specifically probes hard-coded .secrets paths under the user's home/workspace and reads them directly. This is more than an omitted detail because the documentation suggests a generic config source while the code actively reaches into local secret storage locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code caches the WeChat access token in a predictable temp-directory file without setting restrictive permissions or warning the user that credentials will persist on disk. On multi-user systems or environments with weak temp-file isolation, another local user or process could read or replace the token, enabling unauthorized API actions as the公众号.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The README content is entirely in Chinese and does not indicate that the skill is region- or language-specific, nor does it offer users a language option. This can violate language/locale policy when a specific language is effectively forced without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The package description states the skill purpose in Chinese for key functional terms such as '草稿发布、菜单管理、自动回复、Markdown排版' while providing no indication that the skill is region- or language-specific or that users can opt into that locale. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The module docstring and command-line messages are presented only in Chinese, which imposes a specific language on users without opt-in or alternative locale support. This matches the policy concern for language or locale restrictions expressed in natural-language content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The comments and docstring around md_to_html describe producing WeChat-compatible HTML with inline styles and say CSS rules are converted to inline style form. However, the code simply appends a style block, which contradicts the documented behavior and could mislead reviewers about compatibility and side effects.

Content

No source excerpt is available for this finding.