Security audit

Wechat Search Weread

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent WeChat article-search purpose, but its setup exposes a powerful browser-control port, leaves persistent network rules, includes a plaintext API key, and handles login artifacts in predictable temp files.

Review carefully before installing. Only use this in an isolated browser profile, do not expose CDP to your LAN, remove any Windows portproxy/firewall rules after use, treat the documented API key as compromised, and avoid scanning QR login codes or running cleanup against a browser profile that has unrelated tabs or accounts.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/wsl-cdp-browser.md:37
Finding: Unauthenticated CDP Browser Control Exposed on All Network Interfaces
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: references/wsl-cdp-browser.md:37
Finding: Persistent Port Proxy and Firewall Exception Lack Teardown
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/api-limitations.md:21
Finding: Plaintext WeChat Read API Key Committed to Documentation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/detailed-workflow.md:110
Finding: Predictable Shared Temporary Files Store Login and Search Data
Content: View full analysis
f.remove()); const imgs = document.querySelectorAll('img'); for (const img of imgs) { if (img.width > 100 && img.height > 100) return img.src; } return ''; })()" > /tmp/qr_url.txt python3 -c " import json, base64, os with open('/tmp/qr_url.txt') as f: raw = f.read().strip() src = json.loads(raw) if not src: print('ERROR: no QR image found') exit(1) if src.startswith('data:image'): b64 = src.split(',', 1)[1] b64 += '=' * (4 - len(b64) % 4) if len(b64) % 4 else '' with open('/tmp/weread_qr.png', 'wb') as f: f.write(base64.b64decode(b64)) else: import subprocess; subprocess.run(['curl', '-s', '-o', '/tmp/weread_qr.png', src]) print(f'QR OK: {os.path.getsize(\"/tmp/weread_qr.png\")} bytes') " ``` Search results are similarly stored at predictable paths: ```python with open('/tmp/urls.json', 'w') as f: json.dump(articles, f, ensure_ascii=False, indent=2) ``` ### Technical Analysis The workflow uses fixed names under the globally shared `/tmp` directory for login QR data, metadata, and extracted article URLs. It does not create files atomically, request restrictive permissions explicitly, verify ownership, or reject symbolic links. A local attacker can predict these paths. Depending on host configuration and process permissions, the attacker may monitor the files, replace them, or pre-create symbolic links that redirect writes to another writable target. The QR files are deleted only after successful login. Errors, interruption, or process termination can leave login ar ...[truncated 1246 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/detailed-workflow.md:380
Finding: Cleanup Routine Closes Browser Tabs Not Created by the Skill
Content: View full analysis
1: for t in weread_tabs[1:]: subprocess.run(['curl', '-s', '-o', '/dev/null', f'http://$WINDOWS_IP:9223/json/close/{t[\"id\"]}']) print(f'Closed duplicate weread: {t[\"id\"]}') print('Done — only weread login page remains') " ``` ### Technical Analysis The cleanup logic closes every page whose URL does not contain `weread.qq.com`, regardless of whether the Skill created that tab. It then closes additional WeChat Read tabs without tracking which tab is the intended retained target. Resource ownership is inferred only from domain matching. No list of Skill-created target IDs is maintained. As a result, unrelated tabs in the same debug browser can be terminated. A dedicated debug profile reduces the likelihood of unrelated tabs, but it does not provide a reliable ownership guarantee. Users or other automation may sti ...[truncated 776 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation exposes what appears to be a live WeRead Agent API key in plaintext. Even though it is presented as a test artifact, publishing valid credentials enables unauthorized use of the associated account or quota and may expose internal capabilities beyond the skill's stated purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A hard-coded API key embedded in documentation is still a credential disclosure, regardless of whether it is executable code. Attackers routinely scrape repositories and docs for secrets, and the surrounding text explicitly labels it as an API key and test timestamp, increasing the likelihood it is real and usable.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/detailed-workflow.md (reported line 155)May include surrounding context.
登录成功后清理临时文件：

bash
rm -f /tmp/weread_qr.png /tmp/qr_url.txt

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The guide instructs users to expose the Chrome/Edge DevTools Protocol by binding a Windows port proxy to 0.0.0.0 and adding a firewall allow rule, which can make the browser debugging interface reachable beyond the intended WSL boundary. CDP commonly permits powerful browser control, page inspection, cookie/session access, and arbitrary navigation, so unintended network exposure can enable full browser compromise from other hosts on the network.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/wsl-cdp-browser.md (reported line 52)May include surrounding context.
bash
WINDOWS_IP=$(ip route | grep default | awk '{print $3}') curl -s "http://${WINDOWS_IP}:9223/json/version" | python3 -c "import sys,json; print(json.load(sys.stdin).get('Browser','FAIL'))" # 输出浏览器名称即成功

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README describes activation in very broad natural-language terms such as telling the agent to 'search whatever you want,' without defining narrow trigger conditions, confirmation requirements, or scope limits. This can cause unintended invocation during ordinary conversation and may lead the agent to launch browser automation, initiate QR-code login flows, and persist search results to local files when the user did not explicitly intend to use this skill.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs the agent to use browser automation, shell commands, local temporary files, and networked access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and reviewability: an agent runtime may grant broader capabilities than intended, making risky actions like shell execution, file writes under /tmp, and authenticated web access easier to abuse or harder to constrain.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow explicitly extracts a WeRead login QR code, writes its source to /tmp/qr_url.txt, decodes or downloads the image to /tmp/weread_qr.png, and instructs the agent to immediately send that authentication artifact to the user. A login QR code is sensitive authentication material; storing it in predictable world-accessible temp paths without an explicit warning, access controls, or guaranteed secure deletion increases the risk of unintended disclosure or reuse by other local processes or logs.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The function uses the Chrome DevTools Protocol /json endpoint to enumerate tabs and then forcibly closes any page whose URL matches mp.weixin.qq.com. That capability exceeds the stated purpose of searching and extracting article metadata/links, and it can interfere with unrelated user/browser state or destroy in-progress work if the same browser session is shared.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown skill reference forces a specific language/locale for all instructions and examples, which can violate language-choice policy when no user opt-in or region-specific justification is provided. Because the file contains only Chinese-language guidance and no alternative language option, users who do not read Chinese may be excluded.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/search_weread.py (reported line 26)May include surrounding context.
python
def get_search_page_ws(): """获取搜索页面的 WebSocket URL""" result = subprocess.run( ['curl', '-s', f'http://{WINDOWS_IP}:{CDP_PORT}/json'], capture_output=True, text=True )

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This markdown file contains executable template code that writes extracted article metadata and URLs to /tmp/urls.json, and elsewhere also redirects scraped data into /tmp/arts.json and /tmp/urls_raw.json. The document explains how to do this, but it does not include any warning about storing scraped content locally or the privacy implications of extracting and retaining article data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains user-facing natural-language strings only in Chinese in the module docstring and usage text. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale limitation is explicitly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.