T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wechat_fetch_lite.py:40- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Wechat Fetch Publish
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to fetch WeChat articles as advertised, but it uses broad network, browser, file, and cookie capabilities with weak scoping and risky browser settings.
Install only if you are comfortable with a WeChat scraping tool that can fetch arbitrary URLs, write local files, download many images, store/reuse browser cookies, and run Chromium with weakened security settings. Prefer using the Lite mode on trusted mp.weixin.qq.com URLs, avoid opening generated HTML from untrusted pages, and run it in a contained environment with limited network and filesystem access.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/wechat_fetch_v3.py:35- Finding
Remote Pages Execute in Chromium with Critical Security Boundaries Disabled
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wechat_fetch_lite.py:244- Finding
Unsanitized Remote Content Is Written to Executable HTML Files
- Content
View full analysis
str: """Convert to HTML""" return f""" {result['title']}{result['title']}
Account: {result['author']}
Publication time: {result['publish_time']}
Original URL: {result['url']}
{result['content_html']}
Fetch time: {result['fetch_time']}
""" ``` The Playwright implementation uses the same direct interpolation pattern: ```python def _to_html(self, result: Dict) -> str: """Convert to complete HTML""" return f""" {result['title']}{result['title']}
Account: {result['author']}
Publication time: {result['publish_time']}
Original URL: {result['url']}
{result['content_html']}
Fetch time: {result['fetch_time']}
""" ``` ### Technical Analysis The generated HTML directly incorporates remote metadata and article markup. The title, author, publication time, original URL, and `content_html` are not escaped or sanitized. An attacker-controlled page can therefore inject active content such as: - `- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:8- Finding
Dependencies and Browser Binaries Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wechat_fetch_lite.py:145- Finding
Unbounded Image Downloads Permit Memory and Disk Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documents capabilities that perform network access plus local file and image writes, but it declares no tool scope or permission boundaries. In an agent environment, that omission can allow broader-than-expected execution, reducing visibility and user consent for filesystem changes and bulk remote fetching.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file includes the tool description, docstrings, CLI help text, and runtime status messages in Chinese, with no indication that users can opt into another language. That is a natural-language locale policy issue because it imposes a language preference on all users rather than offering a choice or documenting a region-specific need.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
In no-login mode the script launches Chromium with '--disable-web-security' and '--disable-features=IsolateOrigins,site-per-process', which turns off major browser isolation protections while loading attacker-controlled remote pages. Because this tool intentionally visits arbitrary URLs and renders their JavaScript, a malicious page could gain broader cross-origin access or exploit weakened site isolation, increasing the blast radius beyond normal scraping risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language instructions, headings, and feature descriptions are presented only in Chinese, which effectively forces a specific language for users. The rule allows locale constraints when choice or justification is provided, but this README does not offer an alternative language or explain a required Chinese-only scope.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The markdown documents batch fetching with an output directory and elsewhere advertises automatic image downloads, which implies local file creation. Under the markdown variant of SQP-2, user-facing documentation should warn when behavior may affect user data or system state, but this README presents the operations as features without any cautionary note.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documentation encourages batch downloading and local image/output generation without prominently warning that running the skill will create files and generate potentially large volumes of network traffic. In agent workflows this can lead to surprise filesystem modification, excessive downloads, or accidental misuse at scale.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The HTTP session hard-codes an
Accept-Languageheader preferringzh-CN, zhahead of English. This imposes a locale choice in the skill behavior without exposing a user option or documenting an opt-in, which matches the language/locale policy violation criteria.- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This manifest describes capabilities broadly as a WeChat article scraping tool, but provides no explicit trigger phrases, activation conditions, or exclusion criteria. In a manifest file, that lack of specificity can make it unclear when the skill should be invoked versus when a general request about articles or WeChat should not map to this skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The primary natural-language description is written in Chinese and does not indicate that language selection is optional or that the skill is intentionally region-specific. That can create a language/locale policy issue if users are not given a choice or the locale constraint is not documented.
- Content
Static analysis
No suspicious patterns detected.