ZM Markdown 转公众号格式工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:40 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent WeChat Markdown publishing helper, but it relies on a mutable external CLI that may receive WeChat credentials and perform account-changing uploads.

Install only if you trust the maintainer and the external zm-md2wechat-conversion-tool distribution path. Prefer a pinned, reviewed CLI version, provide WeChat credentials only for upload or draft actions, and avoid running credential-bearing commands on Markdown or images you do not intend to process for WeChat.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned External CLI Dependency from Mutable Third-Party Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Supply-chain risk caused by mutable, externally distributed dependencies
Risk Level: Medium

Vulnerable Code Snippet

yaml

metadata: {"clawdbot":{"emoji":"📝","requires":{"bins":["zm-md2wechat-conversion-tool"],"env":["WECHAT_APPID","WECHAT_SECRET"]},"install":[{"id":"brew","kind":"brew","formula":"geekjourneyx/tap/zm-md2wechat-conversion-tool","bins":["zm-md2wechat-conversion-tool"],"label":"Install zm-md2wechat-conversion-tool (brew)"},{"id":"go","kind":"go","module":"github.com/geekjourneyx/zm-md2wechat-conversion-tool-skill/cmd/zm-md2wechat-conversion-tool@latest","bins":["zm-md2wechat-conversion-tool"],"label":"Install zm-md2wechat-conversion-tool (go)"}]}}

Technical Analysis

The skill offers two installation sources for its required executable:

1. A custom Homebrew tap, geekjourneyx/tap.
2. A Go module resolved using the mutable @latest selector.

Neither installation declaration pins the executable to an immutable, audited release artifact or supplies a checksum or signature for verification. In particular, @latest can resolve to different code over time without any corresponding change to this reviewed skill package.

The actual CLI implementation is not included in the audited artifact. Consequently, its behavior cannot be verified from the project files, even though the skill directs the executable to process local Markdown and image files, access WeChat credentials, call remote services, and upload content.

This is a supply-chain weakness rather than evidence that the current upstream package is malicious. Exploitation requires compromise or malicious modification of an upstream repository, release process, package source, or distribution account.

Attack Path

1. An attacker compromises the Go repository, release pipeline, custom Homebrew tap, or associated maintainer account.
2. The attacker publishes a modified version of `zm-md2 ...[truncated 1469 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the Go @latest selector with a specific reviewed semantic version, for example:

   text

   github.com/geekjourneyx/zm-md2wechat-conversion-tool-skill/cmd/zm-md2wechat-conversion-tool@vX.Y.Z
   

2. Pin Homebrew installation to a versioned formula backed by an immutable release artifact rather than relying solely on a mutable custom tap reference.

3. Publish cryptographic checksums for release artifacts and verify them during installation.

4. Sign releases using a verifiable mechanism such as Sigstore/cosign, signed tags, or another documented signing process.

5. Record the exact dependency version reviewed with each skill release and require explicit review before upgrading it.

6. Prefer reproducible builds and document how users can verify that a distributed binary corresponds to the reviewed source revision.

7. Run the CLI with least privilege:

   • Provide WeChat credentials only for operations that require them.
   • Restrict filesystem access to required input and output locations where sandboxing is available.
   • Restrict outbound network access to documented service endpoints.
   • Separate local conversion from credential-bearing publishing operations.

8. Include the executable source or a verifiable source revision in the audit scope so that its file, credential, network, and command-execution behavior can be independently reviewed.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

- generate a local preview artifact or upload drafts
- inspect live capabilities, providers, themes, and prompts
- generate covers, infographics, or other article images
- create image posts
- write in creator styles or remove AI writing traces

## Intent Routing

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The heading specifies "Markdown 转公众号," which indicates a fixed Chinese/WeChat-publication context and implies a language/locale constraint. The file does not offer any user choice or document why this locale-specific constraint is required, which matches the policy's language/locale violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire execution prompt is written as mandatory Chinese instructions, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only regional/compliance context. This creates a natural-language locale policy issue because it implicitly enforces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The title is written entirely in Chinese ('AI 可执行性审核表｜Markdown 转公众号'), which implies a fixed language/locale for the skill context. There is no indication in the file that users may choose another language or that the Chinese-only scope is intentionally limited to a region-specific use case.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.