T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wechat_articles.py:35- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
wechat_articles 公众号文章收集器
Security checks for vulnerabilities and agentic risk
Overview
This WeChat article reader is useful but needs review because it can be steered to fetch non-WeChat or internal URLs and write screenshots to arbitrary writable paths.
Install only in an isolated, low-privilege environment with outbound network controls. Prefer a version that validates https://mp.weixin.qq.com URLs, blocks private or localhost destinations and unsafe redirects, confines screenshots to a dedicated output directory, and pins dependencies before using it on sensitive machines or networks.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wechat_articles_playwright.py:35- Finding
Caller-Controlled Screenshot Path Allows Arbitrary Writable File Overwrite
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:25- Finding
Unpinned Third-Party Dependencies Create a Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding is credible because the manifest claims a complete WeChat article workflow while also exposing an undeclared screenshot option, which expands data collection beyond the stated purpose. Undeclared capabilities and overstated descriptions reduce transparency and can lead to collection of more content than users or the platform expect.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This finding is credible because the manifest claims a complete WeChat article workflow while also exposing an undeclared screenshot option, which expands data collection beyond the stated purpose. Undeclared capabilities and overstated descriptions reduce transparency and can lead to collection of more content than users or the platform expect.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill explicitly requires network-capable packages and is designed to fetch external WeChat content, but it does not declare any tool scope or allowed-tools boundary. That creates a governance gap: the runtime may permit outbound requests without clear least-privilege constraints, making misuse or unintended data egress harder to control and audit.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The catch-all language says the skill should trigger even when the user does not explicitly mention WeChat, as long as the request 'involves' public-account content acquisition. In practice, that can hijack unrelated or ambiguous workflows and silently expand use of networked scraping behavior, which is risky because the skill fetches external content and may invoke browser automation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation rule covers vague requests for information from the broader WeChat ecosystem, which can cause the skill to trigger for loosely related prompts rather than only explicit article-reading tasks. Overbroad activation increases the chance of unnecessary browsing, external requests, and data retrieval outside user intent, especially in an agentic environment where skill routing is automatic.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains natural-language strings entirely in Chinese in the module docstring and CLI usage text, with no indication that the user can choose another language. The policy flags skills that force a specific language or locale without opt-in, and no region-specific justification is provided here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and command help text are written entirely in Chinese, indicating the skill is designed for a single language/locale with no opt-in or alternative. Under the policy, language constraints should either be optional for users or clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
该文件是代码文件，因此只需检查适用于代码的 SQP-2 和所有文件适用的 SQP-3。L044 将语言/区域偏好硬编码为中文，属于自然语言/locale 约束；文件中没有看到用户可选择语言或对该限制作出明确、正当的说明。
- Content
Static analysis
No suspicious patterns detected.