微信公众号文章抓取 (Jeff版)

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:38 PM UTC
• Version: 1.0.0

Overview

This skill mostly does what it claims, but its default image downloader can be steered by article content to fetch arbitrary URLs and save unbounded responses locally.

Review this skill before installing. It is not clearly malicious, but use it in a low-privilege virtual environment or container, prefer --no-images for untrusted articles, choose a dedicated output directory, and avoid running it where internal web services or sensitive network metadata are reachable until image URL allowlisting, size limits, and pinned dependencies are added.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wechat_to_md/downloader.py:38

Finding

Article-Controlled Image URLs Enable Server-Side Request Forgery and Unbounded Downloads

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned Third-Party Dependencies Create a Non-Reproducible Supply-Chain Boundary

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill exposes capabilities that imply network access plus local file read/write, but the manifest does not declare any tool scope or permission boundaries. That makes the skill harder to review safely and may allow it to run with broader effective privileges than a user or platform reviewer expects, which is especially relevant here because the skill downloads remote content and writes files locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When parsing or CAPTCHA handling fails, the tool writes the full fetched HTML to a debug file on disk. WeChat article pages can contain personal data, account-specific tokens, tracking parameters, session-linked content, or other sensitive material; persisting this without clear user consent or retention controls increases the chance of unintended disclosure through local compromise, backups, shared workstations, or later exfiltration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file documents that the tool writes converted articles and downloaded images into an output directory, and elsewhere notes that --force can overwrite existing output. While the behavior is described functionally, there is no clear warning callout that running the tool will create and potentially overwrite local files, which is a user-impacting operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The document includes a full Chinese-language section and presents bilingual navigation, but the file itself does not force a single language overall because English is also available. However, the Chinese section by itself is not a policy violation when considered in context, so no stronger finding is warranted; this is borderline and low confidence.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency markdownify is unpinned, so installations may resolve to different versions over time, including versions with breaking changes or newly disclosed vulnerabilities. In a tool that fetches and converts untrusted web content, dependency drift increases supply-chain and reproducibility risk.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

camoufox[geoip]
markdownify
beautifulsoup4
httpx
mcp

Unverifiable Dependency: markdownify has 2 known advisory(ies) (CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo); CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

markdownify has known advisories, but because no version is pinned, it is impossible to determine whether the installed release is affected. This uncertainty is material here because the skill converts remote article HTML into Markdown, so vulnerable parsing/conversion behavior could be triggered by malicious content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency beautifulsoup4 is unpinned, which makes builds non-reproducible and can silently introduce vulnerable or incompatible releases. Because this skill parses attacker-controlled HTML from external articles, parser-related dependency changes could affect security and stability.

Content

Scanner excerpt · scripts/requirements.txt (reported line 3)May include surrounding context.

text

camoufox[geoip]
markdownify
beautifulsoup4
httpx
mcp

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency httpx is unpinned, allowing package resolution to vary across environments and over time. Since this tool performs network requests to fetch remote content, an unpinned HTTP client increases exposure to supply-chain issues and to inadvertently installing a version affected by known flaws.

Content

Scanner excerpt · scripts/requirements.txt (reported line 4)May include surrounding context.

text

camoufox[geoip]
markdownify
beautifulsoup4
httpx
mcp

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

httpx has known advisories, and the lack of version pinning prevents verification that a safe release will be installed. Because this skill retrieves external content over the network, uncertainty in the HTTP client version creates avoidable risk around request handling and input validation issues.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency mcp is unpinned, which is especially risky given the package's broad functionality and history of multiple advisories. Unpinned SDK/framework dependencies can pull in vulnerable releases unexpectedly and make it difficult to verify the security posture of deployed builds.

Content

Scanner excerpt · scripts/requirements.txt (reported line 5)May include surrounding context.

text

markdownify
beautifulsoup4
httpx
mcp

Unverifiable Dependency: mcp has 12 known advisory(ies) (CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2026-52870 (MCP Python SDK: Experimental task handlers allow any client to access and cancel) +9 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

mcp has numerous known advisories, but the manifest does not specify a version, so the deployment may resolve to a vulnerable release without visibility. Given that MCP components can expose protocol/server features, using an unverifiable version materially increases the chance of inheriting network-facing or access-control weaknesses.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.