Wechat Image Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:53 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches its image-generation purpose, but its screenshot and local-server helpers create command-execution and file-exposure risks that need review before installation.

Install only if you are comfortable running local Python scripts and browser automation from this package. Use it on trusted generated files, avoid passing arbitrary filenames to auto_screenshot.py, and do not run the server on untrusted networks unless it is changed to bind to 127.0.0.1 and serve only the intended output directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/auto_screenshot.py:14

Finding

Shell Command Injection Through Attacker-Controlled HTML Path

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/serve.py:15

Finding

Unauthenticated HTTP Server Exposed on All Network Interfaces

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

If the underlying implementation runs a local HTTP server and serves files over localhost while claiming only to generate article images, the skill exposes undeclared network-facing behavior. Even on localhost, hidden server behavior expands attack surface, can expose local content, and undermines trust in the skill’s stated purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the underlying implementation runs a local HTTP server and serves files over localhost while claiming only to generate article images, the skill exposes undeclared network-facing behavior. Even on localhost, hidden server behavior expands attack surface, can expose local content, and undermines trust in the skill’s stated purpose.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The tool command parameter includes a file URL built from external input and is passed through a shell, allowing parameter or command manipulation. Because the skill's purpose is image creation, not arbitrary command execution, this mismatch makes the issue more dangerous: an attacker could turn a screenshot request into execution of unintended shell commands or malicious browser invocations.

Content

Scanner excerpt · scripts/auto_screenshot.py (reported line 23)May include surrounding context.

python

# Open in browser
    open_cmd = f'browser open --url "{file_url}"'
    result = subprocess.run(open_cmd, shell=True, capture_output=True, text=True)
    
    if result.returncode != 0:
        print(f"❌ Failed to open browser: {result.stderr}")

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/auto_screenshot.py (reported line 36)May include surrounding context.

python

# Take screenshot
    screenshot_cmd = f'browser screenshot --type png --fullPage'
    result = subprocess.run(screenshot_cmd, shell=True, capture_output=True, text=True)
    
    if result.returncode != 0:
        print(f"❌ Failed to take screenshot: {result.stderr}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises executable workflows that invoke Python scripts, write output files, and rely on browser automation, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: an agent may grant broader-than-expected shell and filesystem access when activating the skill, increasing the chance of unintended command execution or file modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger phrases are broad enough to match ordinary image-related requests, which can cause the skill to activate unexpectedly. Over-broad activation is risky because it may invoke shell, file, or browser-capable workflows in contexts where the user only asked for general help, increasing the chance of unnecessary privileged actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The helper introduces shell command execution and browser automation capabilities that exceed simple image-generation logic and widen the attack surface. In the context of a skill meant to generate WeChat images, accepting local HTML and opening it in a browser can expose the environment to command injection, unsafe local-file rendering, or unintended access to local/browser resources.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

This command is executed through the shell while embedding user-influenced data derived from html_path into the command string. Even though the path is wrapped in double quotes, shell metacharacters such as command substitution can still be interpreted, enabling command injection if an attacker controls the input path; this is especially risky in an automation helper that launches browser tooling.

Content

Scanner excerpt · scripts/auto_screenshot.py (reported line 23)May include surrounding context.

python

# Open in browser
    open_cmd = f'browser open --url "{file_url}"'
    result = subprocess.run(open_cmd, shell=True, capture_output=True, text=True)
    
    if result.returncode != 0:
        print(f"❌ Failed to open browser: {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/auto_screenshot.py (reported line 36)May include surrounding context.

python

# Take screenshot
    screenshot_cmd = f'browser screenshot --type png --fullPage'
    result = subprocess.run(screenshot_cmd, shell=True, capture_output=True, text=True)
    
    if result.returncode != 0:
        print(f"❌ Failed to take screenshot: {result.stderr}")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documentation and usage guidance are primarily presented in Chinese, which can impose a language constraint on users without opt-in or an explicit note that the skill is intended for a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user choice or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file instructs users to launch python3 -m http.server 8765 and open generated HTML in a browser, which affects local system behavior and can expose files in the output directory over the local network depending on environment configuration. The README presents this as a routine step but does not include any warning or disclosure about the server exposure or the fact that generated files will be served via HTTP.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The trigger list is entirely Chinese and the examples center on Chinese-language usage, but the description does not state that the skill is intentionally limited to Chinese-speaking or WeChat-specific users. That can amount to an implicit language/locale constraint without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document declares lang="zh-CN", which hard-codes Simplified Chinese as the page language. Under the policy, forcing a specific language or locale without offering user choice or documenting a justified region-specific constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document sets lang="zh-CN", which hard-codes a specific language/locale in the skill asset. Under the policy rules, locale-specific behavior should be optional or clearly justified, and this file provides neither a user opt-in nor a documented regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The document declares lang="zh-CN", which hard-codes a specific language/locale. Under the policy criteria, forcing a locale without opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document sets the page language to "zh-CN", and the visible chart labels are also Chinese, which indicates a fixed language/locale choice. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document sets lang="zh-CN", which hard-codes a specific language/locale. Under the policy criteria, forcing a locale without opt-in or clear justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document sets lang="zh-CN", which specifies a fixed language/locale for the skill output. Under the policy, locale constraints should either offer user opt-in or be clearly documented as necessary for a region-specific use case, neither of which is present in this file.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This is a manifest file, so vague-trigger review applies. The description says the skill can 'Generate beautiful images for WeChat articles' but provides no explicit trigger phrases, scope boundaries, or exclusion conditions, which could make invocation matching overly broad for generic image-generation requests.

Content

No source excerpt is available for this finding.