Wechat Publisher DraftGet

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 0.1.1

Overview

This skill is a coherent WeChat draft-publishing helper, with expected credential use and network upload behavior for that purpose.

Install only if you intend to let an agent create WeChat Official Account drafts. Treat the WeChat AppID/AppSecret as sensitive, confirm the article and images are meant to be uploaded to WeChat, and protect the generated verification files because they may contain unpublished draft content and metadata.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises an end-to-end publishing workflow using md2wechat for already-prepared article content, with explicit draft/get verification before success. The supplied code does none of that. It neither accepts nor processes HTML/Markdown, nor calls any draft creation, retrieval, or publishing functionality. Its sole purpose is setup validation: checking that md2wechat is installed, that a config file exists, and that the config validates. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill clearly describes capabilities that require reading local files, writing artifacts, using environment-backed credentials, and making network calls to WeChat, yet it declares no explicit tool scope or permissions boundary. That creates an overbroad execution surface where an agent may invoke sensitive capabilities without an auditable least-privilege contract, increasing the chance of unintended data access or exfiltration during publishing.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

Use `wechat-publisher-md2wechat-draftget` when the user wants to:

- push a prepared WeChat article into the Official Account draft box
- turn Markdown into WeChat-compatible HTML and then create a draft
- use a stable publishing wrapper instead of manually chaining `upload_image -> create_draft -> draft/get`
- verify that a draft really exists in the WeChat backend before reporting success
- troubleshoot the current `md2wechat create_draft` publishing chain

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to publish content to WeChat and verify remote draft creation, but it does not prominently warn that article HTML/Markdown, metadata, cover images, and related assets will be transmitted to third-party servers and persisted as remote drafts. Users may unknowingly expose sensitive, unpublished, or proprietary content because the privacy and persistence consequences are under-disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document promotes automatic image uploading and one-click publishing to an external platform without clearly warning that local content and images will be transmitted off-host and potentially published publicly. In the context of a publishing skill, this increases the risk of accidental disclosure of sensitive text, metadata, or embedded local assets because users may treat the workflow as a harmless local formatting step.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The script places the WeChat app secret in the token request URL query string when calling the token endpoint. Secrets embedded in URLs can be exposed via process listings, shell tracing, proxy logs, HTTP client diagnostics, or exception logs, increasing the risk of credential leakage even though the destination is the legitimate WeChat API.

Content

Scanner excerpt · scripts/publish.sh (reported line 141)May include surrounding context.

sh

secret=(cfg.get('wechat') or {}).get('secret') or os.getenv('WECHAT_SECRET')
if not appid or not secret:
    raise SystemExit('缺少 WECHAT_APPID / WECHAT_SECRET 或 md2wechat config wechat 配置')
url='https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid='+urllib.parse.quote(appid)+'&secret='+urllib.parse.quote(secret)
with urllib.request.urlopen(url, timeout=20) as r:
    token_resp=json.loads(r.read().decode())
result={'target_media_id':media_id,'token_response':{k:('***' if k=='access_token' else v) for k,v in token_resp.items()}}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish.sh (reported line 148)May include surrounding context.

sh

if 'access_token' not in token_resp:
    result.update({'passed':False,'error':'no access_token'})
else:
    req=urllib.request.Request('https://api.weixin.qq.com/cgi-bin/draft/get?access_token='+urllib.parse.quote(token_resp['access_token']), data=json.dumps({'media_id':media_id},ensure_ascii=False).encode(), headers={'Content-Type':'application/json'}, method='POST')
    with urllib.request.urlopen(req, timeout=20) as r:
        draft_resp=json.loads(r.read().decode())
    item=(draft_resp.get('news_item') or [{}])[0] if isinstance(draft_resp.get('news_item'), list) else {}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file documents use of appid and secret and a workflow that publishes content to a live WeChat draft box, but it does not explicitly warn users that the skill handles credentials and sends article data and assets to external WeChat services. While the operational steps are described, there is no clear caution about credential sensitivity or external data transmission impact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script's comments, usage text, and runtime status messages are written in Chinese throughout, which imposes a specific language on users. The file does not offer an alternative language or explain that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.