Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: uploads user-provided images and text to WeChat to create draft-only posts, with no hidden publishing or persistence behavior found.
Install only if you intend to let the skill upload selected local images and draft text to your WeChat Official Account. Keep WECHAT_APP_SECRET private, avoid committing wechat.env or output records, and review generated drafts manually in WeChat before publishing.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
def get_access_token(app_id: str, app_secret: str) -> str:
r = requests.get(
f'{API_BASE}/token',
params={
'grant_type': 'client_credential',
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
def add_material_image(access_token: str, image_path: Path):
mime = mimetypes.guess_type(str(image_path))[0] or 'image/jpeg'
with image_path.open('rb') as f:
r = requests.post(
f'{API_BASE}/material/add_material',
params={'access_token': access_token, 'type': 'image'},
files={'media': (image_path.name, f, mime)},
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
]
}
body = json.dumps(payload, ensure_ascii=False).encode('utf-8')
r = requests.post(
f'{API_BASE}/draft/add',
params={'access_token': access_token},
data=body,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## API flow used by this skill
1. Get access token
- `GET /cgi-bin/token`
2. Upload each local image as a permanent image material
- `POST /cgi-bin/material/add_material?type=image`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Security / publishing hygiene
Do not publish:
- access tokens
- app ids / secrets
- output logs containing real media IDs or remote asset URLs if they are not intended for distribution
- local absolute paths from the author's private workspace
The skill declares no explicit tool scope or permission boundary even though its documented behavior requires reading local files, writing output records, accessing environment variables or a local credential file, and making network requests to the WeChat API. Without an allowlist, an agent runtime may grant broader-than-necessary access or leave operators unable to verify what the skill is permitted to do, increasing the risk of unintended file access, credential exposure, or misuse of network capabilities.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
DEFAULT_ENV_CANDIDATES = [
ROOT / 'wechat.env',
]
API_BASE = 'https://api.weixin.qq.com/cgi-bin'
def load_env_file(path: Path):
This code reads sensitive credentials from environment variables and then sends them to a remote WeChat API to obtain an access token. While the behavior is functionally necessary, there is no confirmation prompt, user-facing print/log message, or explanatory comment/docstring disclosing that credentials will be used in a network request.
The script uploads local image files and submits title/text content to external WeChat endpoints, which can transmit user data off-system. There is no confirmation prompt, warning print/log, or explanatory comment/docstring informing the user that local files and provided content are being sent to a remote service.
The dependency is specified as requests>=2.31.0, which allows installation of any future version and makes builds non-reproducible. This can unintentionally introduce vulnerable or breaking releases over time, especially in a skill that interacts with external APIs and may handle access tokens or account content.
requests>=2.31.0
Because requests is not pinned, it is impossible to verify whether the installed version is affected by any of its known advisories. In this skill's context, which likely makes authenticated HTTP requests to the WeChat official API, an affected requests version could expose credentials or weaken transport/security behavior.
The script writes a detailed JSON artifact containing post text, title, author, uploaded filenames, upload responses, and draft API results to disk under outputs/. This creates a local data exposure risk because sensitive or unpublished content may remain on disk longer than intended and could be readable by other local users, backups, or downstream tooling.