Security audit

发表微信公众号文章_无限

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed WeChat publishing workflow, but it can publish publicly and enable rewards without a clear final user approval step.

Review this before installing if you would not want an agent to publish directly from your authenticated WeChat Official Account. Use it only for the intended "无限" publishing workflow, confirm the article content and target collection yourself, and require an explicit final approval before enabling rewards or clicking publish.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill automates actions that can change a live public-facing WeChat Official Account article state, including enabling rewards and publishing, but it provides no explicit user warning, confirmation gate, or requirement to verify publication scope before the final action. This creates a real risk of accidental public posting, monetization changes, or reputational damage if the agent executes the workflow on the wrong content or before human review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill ends by instructing the agent to click preview and then publish a WeChat public article, but it does not require any explicit user confirmation or warn that publication is externally visible and may be difficult to fully retract once distributed. In an automation context, this increases the risk of accidental public release of draft, incorrect, confidential, or non-approved content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly directs the agent/user to enable monetization and publish to a live WeChat Official Account, which can create immediate external effects such as public posting, brand impact, and unintended revenue settings. Because the workflow lacks any confirmation gate, warning, or explicit user approval before irreversible actions, it increases the risk of accidental publication or unauthorized monetization changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill provides a complete workflow for publishing content to a public WeChat Official Account, including final preview and publish steps, but it does not warn that content may be externally disclosed or that publication may be irreversible. Because the skill instructs an agent to take direct publication actions on a public channel, missing confirmation, review, and disclosure safeguards creates a real risk of accidental data leakage or unintended public posting.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrases are very broad and map common user requests like '发布公众号' directly to a high-impact publication workflow. This increases the chance of accidental invocation and unintended content publishing, especially because the skill culminates in an external publication action rather than a reversible local edit.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Hard-coding the author name as '无限' can cause misattribution, policy violations, or unauthorized publication under the wrong identity if the content or account context differs. Because this skill targets real-world publishing, forcing identity metadata without user confirmation is more dangerous than a mere formatting preference.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill performs an externally distributing action ('发布') but frames preview as optional and does not require a strong final warning that publication can notify followers and make content publicly visible. In this context, the absence of an explicit publication-impact warning and final confirmation materially raises the risk of accidental mass distribution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The instructions require the author field to be set to “无限,” which is a hard-coded natural-language/content setting rather than a user-selectable value. Under the policy criteria, fixed language/locale or similar content constraints should either be optional for the user or clearly justified as a scoped organizational requirement.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.