ZM 公众号草稿发布与核验

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:48 AM UTC
• Version: 0.1.0

Overview

This skill is a WeChat draft-publishing helper that performs the remote draft creation it describes, but users should understand it will upload article content and use WeChat credentials.

Install/use this only for accounts where you intentionally want an agent or script to create WeChat Official Account drafts. Review article and image paths before running it, ensure the credentials belong to the intended account, and be aware that content, cover images, AppID/AppSecret-derived authentication, and draft metadata are sent to WeChat. Also check the md2wechat versus zm-md2wechat-conversion-tool naming mismatch before relying on the commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill's documented behavior claims real draft publication and backend verification, but the finding indicates the implementation only validates local setup and does not actually perform the promised draft creation or verification steps. This mismatch is dangerous because operators or downstream agents may falsely believe content was published and verified, leading to integrity failures, broken workflows, or unsafe automation decisions based on nonexistent state.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares no explicit tool scope or permissions despite describing operations that require environment access, file reads/writes, and network calls to WeChat. In an agent framework, this over-broad implicit capability increases the chance of unintended secret exposure, local file access, or outbound publishing actions beyond what a reviewer can safely constrain.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

Use `zm-wechat-draft-publish-verify` when the user wants to:

- push a prepared WeChat article into the Official Account draft box
- turn Markdown into WeChat-compatible HTML and then create a draft
- use a stable publishing wrapper instead of manually chaining `upload_image -> create_draft -> draft/get`
- verify that a draft really exists in the WeChat backend before reporting success
- troubleshoot the current `zm-md2wechat-conversion-tool create_draft` publishing chain

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The content explicitly promotes automatic image upload and one-click publishing to a public-platform draft system without warning the user that local files and remote content may be transmitted over the network and persisted to an external service. In a publishing skill, this can cause unintended disclosure, accidental publication, or transfer of sensitive images/content if a user runs the demonstrated workflow without understanding the side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest describes a skill that publishes prepared content through the md2wechat conversion tool and verifies persistence via draft/get. In addition to invoking that tool, the embedded Python verifier independently reads ~/.config/md2wechat/config.yaml and environment variables to obtain app credentials, which is a separate secret-access capability not declared in the skill description.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish.sh (reported line 141)May include surrounding context.

sh

secret=(cfg.get('wechat') or {}).get('secret') or os.getenv('WECHAT_SECRET')
if not appid or not secret:
    raise SystemExit('缺少 WECHAT_APPID / WECHAT_SECRET 或 md2wechat config wechat 配置')
url='https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid='+urllib.parse.quote(appid)+'&secret='+urllib.parse.quote(secret)
with urllib.request.urlopen(url, timeout=20) as r:
    token_resp=json.loads(r.read().decode())
result={'target_media_id':media_id,'token_response':{k:('***' if k=='access_token' else v) for k,v in token_resp.items()}}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/publish.sh (reported line 148)May include surrounding context.

sh

secret=(cfg.get('wechat') or {}).get('secret') or os.getenv('WECHAT_SECRET')
if not appid or not secret:
    raise SystemExit('缺少 WECHAT_APPID / WECHAT_SECRET 或 md2wechat config wechat 配置')
url='https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid='+urllib.parse.quote(appid)+'&secret='+urllib.parse.quote(secret)
with urllib.request.urlopen(url, timeout=20) as r:
    token_resp=json.loads(r.read().decode())
result={'target_media_id':media_id,'token_response':{k:('***' if k=='access_token' else v) for k,v in token_resp.items()}}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description is written as a Chinese-language-only operation for a WeChat public account workflow, with no indication that users can choose another language or locale. The policy specifically calls for flagging language or locale constraints when they are forced without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The markdown instructions and examples are presented only in Chinese, which may effectively force a specific language for users without offering alternatives or documenting a justified locale restriction. The policy allows locale constraints when clearly documented and justified, but that is not stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments and all user-visible messages are written in Chinese, which imposes a specific language on users. The file does not offer a language/locale choice or state that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The title and field descriptions are written entirely in Chinese, with no indication that other languages are supported or that the language choice is optional. Under the policy rules, a skill that effectively requires a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.