WeChat Official Accounts Article Engagement Metrics API

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.0.0

Overview

This skill does the stated WeChat article-metrics API call, but it handles the required API token in ways that can expose it through command lines and URL logs.

Review before installing. Use only a narrowly scoped, revocable JustOneAPI token, assume the token may appear in process metadata and request URL logs, and rotate it if used in monitored or shared environments. Prefer a version that reads the token from protected process environment or stdin and sends authentication in a header if the API supports it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:130

Finding

API Token Exposed Through Command-Line Arguments

Content

View full analysis

"}' ``` The executable parses and retains that argument: ```js function parseArgs(argv) { const parsed = { operation: null, paramsJson: "{}", token: null }; for (let index = 0; index < argv.length; index += 1) { const flag = argv[index]; const value = argv[index + 1]; if (flag === "--operation") { parsed.operation = value; index += 1; continue; } if (flag === "--params-json") { parsed.paramsJson = value; index += 1; continue; } if (flag === "--token") { parsed.token = value; index += 1; continue; } fail(`Unknown argument "${flag}".`); } return parsed; } ``` ### Technical Analysis Although the shell command references an environment variable, the shell expands it before starting Node.js. The resulting secret is consequently present in the process argument vector. Depending on the operating system and process isolation configuration, command-line arguments may be observable through process inspection interfaces and utilities, process accounting, monitoring agents, diagnostic reports, or container orchestration telemetry. The code does not need to print the token for this exposure to occur. The Skill otherwise restricts outbound communication to the documented HTTPS host and endpoint. No hidden endpoints, arbitrary command execution, persistence, privilege escalation, or encoded payload execution were identified. The exposure is therefore an insecure credential-handling flaw rather than malicious credential exfiltration. ### ...[truncated 1108 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/run.mjs:176

Finding

API Token Transmitted as a URL Query Parameter

Content

View full analysis

parameter.name === "token"); if (!tokenParam || params.token !== undefined) { return; } if (!cliToken) { fail("--token is required for this operation.", { operationId: operation.operationId, }); } params.token = cliToken; } ``` All parameters declared with `location === "query"` are appended to the URL, including the token: ```js function applyQueryParams(operation, params, url) { for (const parameter of operation.parameters.filter((item) => item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } function appendValue(searchParams, name, value) { if (Array.isArray(value)) { for (const item of value) { appendValue(searchParams, name, item); } return; } if (value && typeof value === "object") { searchParams.append(name, JSON.stringify(value)); return; } searchParams.append(name, String(value)); } ``` The resulting credential-bearing URL is then transmitted: ```js response = await fetch(url, requestInit); ``` ### Technical Analysis HTTPS encrypts the request in transit, so passive network observers cannot ordinarily read the query string. However, URL query parameters ar ...[truncated 1917 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This finding is substantiated by the code path that accepts an access token and places it into the URL query string for outbound requests. While the script does not appear to exfiltrate the token beyond the intended API call, handling credentials this way increases exposure risk because URLs are broadly captured by infrastructure and operational telemetry.

Content

Scanner excerpt · bin/run.mjs (reported line 20)May include surrounding context.

js

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for the API.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The API requires an access token to be supplied as a query parameter, which is dangerous because query strings are commonly logged by clients, proxies, gateways, analytics systems, and server infrastructure. This increases the chance of credential disclosure and replay by anyone with access to those logs or captured URLs.

Content

Scanner excerpt · generated/operations.json (reported line 15)May include surrounding context.

json

"parameters": [
        {
          "defaultValue": null,
          "description": "Access token for the API.",
          "enumValues": [],
          "location": "query",
          "name": "token",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generated/operations.md (reported line 19)May include surrounding context.

md

| Name | In | Required | Type | Default | Description |
| --- | --- | --- | --- | --- | --- |
| `token` | `query` | yes | `string` | n/a | Access token for the API. |
| `articleUrl` | `query` | yes | `string` | n/a | The URL of the Weixin article. |

### Request body

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes a network-capable helper (node .../bin/run.mjs) and is explicitly designed to call an external API, but it does not declare any permissions or allowed-tools scope. This creates a governance gap: an agent runtime may allow broader tool or network use than intended, making it harder to constrain, audit, or safely review what external access the skill needs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill defines the API token as a query parameter and later appends all query parameters directly into the request URL. Query-string credentials are commonly exposed through logs, browser/history tooling, reverse proxies, monitoring systems, and error reports, making accidental credential disclosure materially more likely than using an Authorization header.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This manifest describes what the API does but does not define any explicit invocation phrases, scope constraints, or negative examples for when the skill should or should not be used. In manifest files, that lack of trigger specificity can make activation criteria ambiguous and increase the chance of unintended invocation by general requests about article metrics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 61% confidence

Finding

The natural-language description and display name are fixed to 'WeChat Official Accounts,' which implies a specific platform and likely locale context, but the manifest does not state whether this limitation is optional, user-selected, or explicitly justified. Under the locale/policy rule, hard-coded language or regional constraints should be documented or presented as a user choice when applicable.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

• Code: suspicious.secret_argv_exposure
• Location: SKILL.md:41