WeChat Channels Share Downloader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:24 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for downloading WeChat Channels videos, but it has under-controlled file-writing and third-party link disclosure risks users should review first.

Install only if you are comfortable sending WeChat share links to the documented third-party resolver. Avoid sensitive or private links, do not pass untrusted filenames, and prefer a sanitized simple filename until the script validates output paths and media URLs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/download_sph.sh:31

Finding

Arbitrary File Overwrite Through Unsanitized Output Filename

Content

View full analysis

Remediation

View remediation

&2 exit 2 fi ``` 2. Reject empty names, `.` and `..`, path separators, and control characters. 3. Canonicalize the destination and verify that its parent remains the canonical Downloads directory. 4. Reject existing symbolic-link destinations: ```bash if [[ -L "$out" ]]; then echo "Refusing to write through a symbolic link" >&2 exit 2 fi ``` 5. Use exclusive file creation or a securely created temporary file inside `~/Downloads`, then atomically rename it after a successful download. 6. Consider generating the final filename internally and treating any user-provided value only as a sanitized basename. 7. If overwriting existing files is unnecessary, fail when the destination already exists. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/download_sph.sh:5

Finding

Resolver-Controlled URL Is Downloaded Without Scheme or Host Validation

Content

View full analysis

"$profile" ``` ```python if quality == "h265": video_url = (feed.get("h265VideoInfo") or {}).get("videoUrl") or feed.get("videoUrl") else: video_url = (feed.get("h264VideoInfo") or {}).get("videoUrl") or feed.get("videoUrl") if not video_url: raise SystemExit("resolver returned no video URL") ``` ```bash video_url="$(cat "$tmp/video_url")" ``` ```bash curl -fL --retry 2 --connect-timeout 20 -o "$out" "$video_url" ``` ### Technical Analysis The media URL originates in JSON returned by the online resolver. The script checks only whether the value is nonempty. It does not validate: - The URL scheme - The destination hostname - The destination port - Embedded credentials - Whether the address resolves to a loopback, link-local, private, or internal network address - The destinations reached through redirects The `WX_CHANNELS_PROFILE_API` environment variable also allows the resolver itself to be replaced. This configurability is documented, but it increases the importance of treating resolver output as untrusted. Because `curl -L` follows redirects, even an initially acceptable URL could redirect to an unexpected service. Depending on the protocols enabled in the installed curl build, a malicious URL could also select an unintended protocol. The fetched response is written to a local file but is not executed by this script. ### Attack Path 1. An attacker compromises the configured resolver, operates a resolver supplied through `W ...[truncated 1498 chars]

Remediation

View remediation

other

Note

• Location: scripts/download_sph.sh:42

Finding

WeChat Share URL Is Disclosed to a Third-Party Resolver

Content

View full analysis

"$profile" ``` The default endpoint is defined as: ```bash PROFILE_API="${WX_CHANNELS_PROFILE_API:-https://sph.litao.workers.dev/api/fetch_video_profile}" ``` ### Technical Analysis The script sends the complete WeChat share URL to `sph.litao.workers.dev`, a third-party online resolver. A share URL may identify private, unlisted, or otherwise sensitive content and may contain access-bearing identifiers. This network transfer is necessary for the Skill's declared no-install online-resolution architecture. It is also disclosed in `SKILL.md` and `references/commands.md`, so the behavior is not hidden exfiltration. Nevertheless, users may not understand that the complete link leaves their environment or that the resolver can potentially log it. The resolver receives at least the share URL and ordinary network metadata such as the requester's IP address and request time. ### Attack Path 1. A user supplies a WeChat Channels share URL to the Skill. 2. The script serializes the complete URL into a JSON request body. 3. The request is transmitted to the configured third-party resolver. 4. The resolver can inspect, process, or retain the URL and associated network metadata. 5. If the URL grants access to unlisted or restricted-by-link content, anyone with access to resolver logs may be able to identify or access that content, subject to WeChat's own controls. ### Impact Assessment No local or system privileges are gained. The impact is limited to confidentiality and privacy: - Disclosure of the complete share URL to a third party - Possible exposure of ...[truncated 388 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell commands, reads environment-derived paths, and performs network downloads, but it does not declare any explicit tool scope or allowed-tools boundary. That increases the chance an agent can execute broader capabilities than intended, making command execution and external network access less constrained and less auditable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to send WeChat share-link data to a third-party online resolver endpoint, but it does not clearly warn that the link and associated metadata will be disclosed to an external service. Share links may embed identifiers or private-access context, so silent transmission to a non-WeChat resolver creates privacy, logging, and retention risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The curl call posts the provided share URL to an external service (PROFILE_API), creating a real data egress path to a third party. In this skill, that transmission is functionally necessary for resolution, but it is still security-relevant because users may reasonably expect a downloader script to contact the content host, not disclose links to an unrelated resolver endpoint.

Content

Scanner excerpt · scripts/download_sph.sh (reported line 44)May include surrounding context.

sh

trap 'rm -rf "$tmp"' EXIT
profile="$tmp/profile.json"

curl -fsSL "$PROFILE_API" \
  -H 'content-type: application/json' \
  --data "$(python3 -c 'import json,sys; print(json.dumps({"url": sys.argv[1]}, ensure_ascii=False))' "$share_url")" \
  > "$profile"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends the user-supplied WeChat share URL to a third-party resolver API by default, but it does not clearly warn the user at runtime or request confirmation before doing so. Share links can reveal viewing intent, identifiers, or other sensitive metadata, and the skill context explicitly promotes a no-local-install workflow, which makes this external disclosure a core behavior rather than an incidental implementation detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.