Security audit

Wechat Search Weread

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its WeChat article-search purpose, but it needs review because it can expose browser control broadly and writes login/search data to shared temporary files.

Install only if you are comfortable letting an agent control an isolated browser session for WeRead. Avoid using your normal browser profile, do not expose CDP on 0.0.0.0, remove the Windows portproxy/firewall rule after use, and delete /tmp QR/result files when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to use browser automation, shell commands, network access, and local file operations, but it does not declare permissions or clearly bound those capabilities. That mismatch can lead to over-privileged execution, making it harder for users or the platform to understand that the skill will connect to external services, invoke commands, and access local resources such as /tmp.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The documentation includes a live-looking API key (`wrk-FGVctlbTTPaWm7gmFFAi7gAA`) that appears to be an actual credential rather than a clearly fake placeholder. Even if included for testing context, publishing secrets in repository documentation can enable unauthorized API access, quota abuse, billing impact, or downstream compromise if the key remains valid.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README suggests the skill can be triggered by very generic natural-language requests like '搜一下最近关于大模型的公众号文章' or '微信搜索 OpenAI', which can overlap with ordinary chat intent rather than an explicit request to invoke this specific skill. In an agent environment, overly broad activation language can cause unintended browser automation, login prompts, or external searches without sufficiently clear user consent.

Missing User Warnings

Low

Confidence: 77% confidence
Finding: The README states that complete search results are saved to '/tmp/urls.json' but does not clearly warn users that potentially sensitive search queries and collected article metadata will persist locally. Even if '/tmp' is temporary, this creates avoidable data-retention risk in shared, multi-tenant, or logged execution environments.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The skill persists extracted article metadata and direct links to /tmp/urls.json, but the user is not warned that results will be written to local storage. Even though the data is not highly sensitive by default, local persistence can expose search history or retrieved content to other local processes or later sessions, especially on shared systems.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The workflow explicitly instructs extracting, decoding, and saving a live WeRead login QR code to /tmp and then sending it onward. A login QR is authentication material, so storing it in a shared or weakly isolated temporary directory increases the risk of local disclosure, replay during its validity window, or unintended retention in logs/backups.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The document instructs writing article metadata and extracted URLs to /tmp files without any retention, access control, or sensitivity guidance. Search queries, reading targets, and collected article lists can reveal user interests or operational activity, so leaving them in generic temporary storage creates avoidable privacy exposure.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The skill explicitly writes extracted article metadata and URLs to /tmp, which creates local persistence of potentially sensitive browsing-derived data without any retention, cleanup, or user notice. In an agent environment where /tmp may be readable by later tasks or co-tenanted processes, this can expose collected data beyond the user's immediate request.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The instructions configure `netsh interface portproxy` to listen on `0.0.0.0:9223` and add a firewall allow rule, which exposes the browser DevTools Protocol beyond localhost. CDP provides powerful browser control and access to session data, so if the host is reachable from other machines or networks, an attacker could remotely inspect pages, extract data, or drive the browser without authentication.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.