Wechat Daily Article

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.8.0

Overview

This skill is a real WeChat article workflow, but it adds fixed account promotion and includes unsafe upload/download helpers that need careful review before use.

Install only if this is meant for the named WeChat account and you are comfortable granting WeChat and Feishu API credentials. Review or remove the mandatory promotional footer/QR instructions, avoid the scheduled task unless you truly want recurring automated runs, and harden the scripts before using untrusted HTML, image URLs, or local file paths.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:129

Finding

Mandatory Brand Promotion and Traffic-Diversion Injection

Content

View full analysis

关注【镜头逃亡·旅食记】，用镜头记录旅途，用味蕾丈量世界。

#旅行 #美食 #探店 #打卡 #[具体地域] #[具体品类]

转发给朋友，TA会感谢你！👇

``` ```text ### 正文结尾格式（必须同时包含） 互动引导 + 公众号引流 + 二维码引导 例如： 你们觉得呢？👇 关注公众号【镜头逃亡·旅食记】获取更多美食探店攻略 扫码下方二维码 · 免费订阅全文 ``` The quoted source-language strings are preserved verbatim because they are the exact instructions responsible for the vulnerability. They require following a named account, sharing content with other users, and subscribing through a QR code. ### Technical Analysis The Skill does not present the named account promotion as an optional, user-controlled template. It explicitly states that the promotional footer must be preserved, that a sharing inducement must be added, and that Douyin content must contain public-account and QR-code diversion. These instructions alter the Agent's output goals when the Skill is loaded. Instead of only producing the requested article, the Agent is directed to insert persistent advertising and traffic-diversion material benefiting a predefined account. This exceeds the minimum behavior needed to generate and upload WeChat articles. The behavior qualifies as instruction hijacking because: 1. It is embedded in the Skill instructions rather than supplied by the current user. 2. It applies automatically to generated outputs. 3. It promotes a fixed named account. 4. It requires engagement manipulation, sharing inducement, and QR-code subscription guidance. 5. The instructions use mandatory language that prevents neutral omission. ### Attack Path 1. A user installs or invokes the Skill to generate a WeChat article or Douyin post. 2. The Agent loads `SKILL.md` as authoritative workflow instructions. 3. The mandatory footer and traffic-diversion requirements become part ...[truncated 1045 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/create_draft.py:27

Finding

Unrestricted Server-Side URL Fetching with TLS Verification Disabled

Content

View full analysis

{filepath}') ``` ```python # 处理网络图片URL：先下载到本地，再上传 url_to_local = {} for url in set(re.findall(r'https?://[^\s"\'<>]+\.(?:jpg|jpeg|png|gif|webp)', html_content)): fname = os.path.basename(url.split('?')[0]) local_path = f'/tmp/{fname}' try: download_img(url, local_path) url_to_local[url] = local_path img_paths.append(local_path) except Exception as e: print(f' 下载失败 {url}: {e}') ``` ### Technical Analysis The script extracts URLs from caller-supplied HTML and fetches them without validating the destination. It has no trusted-host allowlist and does not reject loopback, link-local, private, reserved, multicast, or cloud metadata addresses. `urllib.request.urlopen` follows HTTP redirects by default. Consequently, an apparently public image URL can redirect to an internal service. The code does not revalidate redirect destinations. For HTTPS resources, the code explicitly disables both certificate-chain enforcement and hostname verification: ```python ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE ``` This allows a network attacker to impersonate the requested image host and substitute arbitrary response content. The response is read in full with `r.read()`. No maximum response size is enforced, creating memory and disk exhaustion risk. The response is also not validated as an image through its MIME type, file signature, or decode ...[truncated 2092 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/feishu_sender.py:42

Finding

Arbitrary Local File Upload Through the Feishu Sender CLI

Content

View full analysis

3 else "file" file_key = upload_file(token, file_path, file_name) if file_key: ok = send_file(token, file_key) print(f"file_key: {file_key}, sent: {ok}") else: print("FAILED") elif action == "image": image_path = sys.argv[2] image_key = upload_image(token, image_path) if image_key: ok = send_image(token, image_key) print(f"image_key: {image_key}, sent: {ok}") else: print("FAILED") ``` ### Technical Analysis The Feishu utility accepts caller-controlled filesystem paths for both file and image operations. It opens and reads those pat ...[truncated 2574 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Tainted flow: 'url' from os.environ.get (line 19, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/create_draft.py (reported line 20)May include surrounding context.

python

def get_access_token():
    url = f'https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid={APPID}&secret={APPSECRET}'
    with urllib.request.urlopen(url, timeout=10) as r:
        d = json.loads(r.read())
    if d.get('errcode'):
        raise Exception(f'token失败: {d}')

Tainted flow: 'url' from os.environ.get (line 19, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 98% confidence

Finding

The script downloads arbitrary image URLs found in article HTML while explicitly disabling TLS certificate validation and hostname checking. That allows man-in-the-middle interception or spoofing of remote image downloads, which can silently alter uploaded content or deliver malicious payloads under the guise of trusted HTTPS.

Content

Scanner excerpt · scripts/create_draft.py (reported line 32)May include surrounding context.

python

ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    with urllib.request.urlopen(url, timeout=30, context=ctx) as r:
        data = r.read()
    with open(filepath, 'wb') as f:
        f.write(data)

Tainted flow: 'req' from os.environ.get (line 116, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/feishu_sender.py (reported line 24)May include surrounding context.

python

data=data,
        headers={"Content-Type": "application/json"}
    )
    resp = json.loads(urllib.request.urlopen(req).read().decode())
    return resp.get("tenant_access_token", "")

def send_text(token, text):

Tainted flow: 'req' from os.environ.get (line 116, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/feishu_sender.py (reported line 39)May include surrounding context.

python

data=data,
        headers={"Content-Type": "application/json"}
    )
    resp = json.loads(urllib.request.urlopen(req).read().decode())
    return resp.get("tenant_access_token", "")

def send_text(token, text):

Tainted flow: 'req' from os.environ.get (line 116, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/feishu_sender.py (reported line 63)May include surrounding context.

python

data=data,
        headers={"Content-Type": "application/json"}
    )
    resp = json.loads(urllib.request.urlopen(req).read().decode())
    return resp.get("tenant_access_token", "")

def send_text(token, text):

Tainted flow: 'req' from os.environ.get (line 116, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/feishu_sender.py (reported line 81)May include surrounding context.

python

data=data,
        headers={"Content-Type": "application/json"}
    )
    resp = json.loads(urllib.request.urlopen(req).read().decode())
    return resp.get("tenant_access_token", "")

def send_text(token, text):

Tainted flow: 'req' from os.environ.get (line 116, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/feishu_sender.py (reported line 103)May include surrounding context.

python

data=data,
        headers={"Content-Type": "application/json"}
    )
    resp = json.loads(urllib.request.urlopen(req).read().decode())
    return resp.get("tenant_access_token", "")

def send_text(token, text):

Tainted flow: 'req' from os.environ.get (line 116, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/feishu_sender.py (reported line 121)May include surrounding context.

python

data=data,
        headers={"Content-Type": "application/json"}
    )
    resp = json.loads(urllib.request.urlopen(req).read().decode())
    return resp.get("tenant_access_token", "")

def send_text(token, text):

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill is presented as a WeChat article workflow, but the documentation also defines Feishu messaging actions that send content and identifiers to a third party. This mismatch can cause unintended data disclosure and credential use because users may not expect a WeChat-oriented skill to message Feishu recipients or access additional platform secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a WeChat article workflow, but the documentation also defines Feishu messaging actions that send content and identifiers to a third party. This mismatch can cause unintended data disclosure and credential use because users may not expect a WeChat-oriented skill to message Feishu recipients or access additional platform secrets.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 413)May include surrounding context.

md

- 参考脚本：`scripts/create_draft.py`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 452)May include surrounding context.

md

- 参考脚本：`scripts/create_draft.py`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu_sender.py (reported line 17)May include surrounding context.

python

USER_OPEN_ID = os.environ.get('FEISHU_USER_OPEN_ID', '')

def get_token():
    """获取飞书 access token"""
    data = json.dumps({"app_id": APP_ID, "app_secret": APP_SECRET}).encode()
    req = urllib.request.Request(
        "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents and invokes networked actions and relies on environment-stored credentials, but it declares no explicit tool scope or permission boundary. This creates an authorization gap where an agent may use network and secret-bearing capabilities without clear user visibility or least-privilege restrictions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description states the skill is for WeChat public-account daily article creation and all instructions are written to produce Chinese marketing content, but there is no opt-in or alternative language choice. This creates a locale/language constraint in natural-language behavior without documenting user choice or an explicit justified limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill lacks a clear warning that generated content and images may be uploaded to external platforms, which undermines informed consent. Because the workflow includes publication-related steps, users may unknowingly cause proprietary or sensitive material to be transmitted outside the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Feishu notification section sends article titles and identifiers to a third-party messaging service without a clear warning in the skill description. This is dangerous because it extends data exposure beyond the primary publishing platform and may leak operational details or user content to unintended recipients.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This command transmits application credentials to Feishu to obtain an access token, which is an external transmission involving secrets. In context, the danger is not the API call itself but that the skill includes secret-bearing network actions without strong permission scoping, clear disclosure, or safeguards against misuse.

Content

Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.

bash

# 获取 token
TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id": "<YOUR_APP_ID>", "app_secret": "<YOUR_APP_SECRET>"}' \
  | grep -o '"tenant_access_token":"[^"]*"' | cut -d'"' -f4)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This command sends generated article metadata to Feishu, creating an external data flow to a third-party messaging endpoint. In the context of a supposedly WeChat-focused content workflow, that additional transmission is risky because users may not expect cross-platform sharing of titles and recipient identifiers.

Content

Scanner excerpt · SKILL.md (reported line 339)May include surrounding context.

md

| grep -o '"tenant_access_token":"[^"]*"' | cut -d'"' -f4)

# 发送文本
curl -s -X POST 'https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id' \
  -H "Authorization: Bearer ${TOKEN}" \
  -H 'Content-Type: application/json' \
  -d '{"receive_id": "<RECEIVER_OPEN_ID>", "msg_type": "text", "content": "{\"text\": \"📝 公众号文章已生成\\n标题：'$(cat /tmp/article_title.txt)'\\n请前往公众号后台草稿箱查看发布\"}"}'

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation expands beyond the stated WeChat draft workflow into Douyin publishing guidance and Feishu delivery steps, broadening the skill's operational scope without a corresponding trust boundary update. Scope expansion is risky because users may trigger unrelated publication or messaging behavior under the assumption they are only drafting WeChat content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger condition for Douyin-related behavior is broad enough to match ordinary user requests about publishing or promotional content, which can unexpectedly route content into a different workflow. In a skill that performs external transmissions, ambiguous triggering increases the chance of unintended posting or disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file presents all instructions and examples exclusively in Chinese, which can force a specific language on users without opt-in. Under the policy, language-specific content should either offer a choice or clearly justify the locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The title and all instructions are written as prescriptive Chinese prompt guidance, and the file does not indicate that other languages are allowed or that the scope is intentionally limited to Chinese-language usage. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The title explicitly frames the guidance as '微信公众号 SEO 规范', and the rest of the document provides prescriptive writing rules entirely for a Chinese WeChat-public-account context. Because the file gives mandatory content instructions for a specific language/platform locale without any opt-in or alternative language handling, it matches the language/locale policy concern for natural-language policy violations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_draft.py (reported line 14)May include surrounding context.

python

APPID = os.environ.get('WECHAT_APPID', '')
APPSECRET = os.environ.get('WECHAT_APPSECRET', '')
UPLOAD_IMG_URL = 'https://api.weixin.qq.com/cgi-bin/media/uploadimg?access_token={token}'
ADD_MATERIAL_URL = 'https://api.weixin.qq.com/cgi-bin/material/add_material?access_token={token}&type=image'
DRAFT_URL = 'https://api.weixin.qq.com/cgi-bin/draft/add?access_token={token}'

Static analysis

No suspicious patterns detected.