Security audit

Wechat Articles Spider

Security checks for vulnerabilities and agentic risk

Overview

The skill broadly matches its advertised crawler-and-payment purpose, but it handles real payments and WeChat session credentials in unsafe ways that users should review before installing.

Review carefully before installing. Use only a secondary WeChat account, do not run paid mainnet USDC flows unless the payment verification bugs are fixed, and keep or remove weixin_credentials.py with the same care as a password. Prefer testing with the free tier or testnet first.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: wechat_mp_crawler.py:210
Finding: Executable Credential File Allows Python Code Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: wechat_mp_crawler.py:569
Finding: WeChat Session Credentials Are Printed and Stored in Plaintext
Content: View full analysis
50 else f"cookie: {self.cookie}" ) ``` ```python # wechat_mp_crawler.py:576-609 token = self.get_token() cookies = self.get_cookies() cookie_str = "; ".join( [f"{cookie['name']}={cookie['value']}" for cookie in cookies] ) content = f"""#!/usr/bin/env python # -*- coding: utf-8 -*- # WeChat Official Platform credentials # Automatically generated at {time.strftime("%Y-%m-%d %H:%M:%S")} # Token required for API requests token = "{token or ''}" # Cookie string required for requests cookie = '{cookie_str}' # Optional cookie dictionary cookie_dict = {{{', '.join([f'"{cookie["name"]}": "{cookie["value"]}"' for cookie in cookies])}}} """ with open(filename, "w", encoding="utf-8") as f: f.write(content) print(f"\nCredentials saved to {filename}") print(f"You can import these credentials using '{filename.replace('.py', '')}'") print("\n==== Copyable credential variables ====") print(f"token = \"{token or ''}\"") print(f"cookie = '{cookie_str}'") ``` ### Technical Analysis The crawler exposes authentication material through two channels: 1. It writes the complete WeChat token and cookie collection to an unencrypted local file. 2. It prints the complete token and cookie string to standard output. Although one earlier message truncates the cookie to 50 characters, `save_credentials_to_py_file()` later prints the complete cookie string. Standard output may be retained in terminal history, CI logs, process supervisors, remote execution logs, or support bundles. The file is created using ordinary `open()` without explicit restrictive permissions. Its effective permissions therefore depend o ...[truncated 1063 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: quota_manager.py:62
Finding: Unvalidated User Identifier Enables Path Traversal
Content: View full analysis
Dict[str, Any]: """Load user data""" if os.path.exists(self.user_file): with open(self.user_file, 'r') as f: return json.load(f) return { "user_id": self.user_id, "created_at": datetime.now().isoformat(), "free_quota": asdict(FreeQuota()), "subscription": asdict(Subscription()), "usage_history": [], } def _save(self) -> None: """Save user data""" with open(self.user_file, 'w') as f: json.dump(self.data, f, indent=2, default=str) ``` ### Technical Analysis The caller-provided `user_id` is inserted directly into a filesystem path. Lowercasing the identifier does not remove path separators or traversal components such as `../`. `os.path.join()` does not guarantee that the resulting path remains beneath `DATA_DIR`. The code performs no canonicalization, allowlist validation, or post-resolution containment check. Because `_load()` reads the selected path and `_save()` writes to it, a crafted identifier can target JSON files outside `data/users`, subject to the operating-system account's permissions. The forced `.json` suffix limits target names but does not prevent directory traversal. ### Attack Path 1. An attacker supplies a user identifier containing traversal components, for example through the CLI `--user` argument. 2. `UserQuotaManager` constructs a path such as `data/users/../../target.json`. 3. `_load()` reads the resolved external JSON file if it e ...[truncated 665 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: spider_api.py:76
Finding: Payment Flow Can Solicit Irreversible Transfers but Fail Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: wechat_mp_crawler.py:351
Finding: Chrome Browser Sandbox Is Explicitly Disabled
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Dependencies and Runtime Browser-Driver Download Create Supply-Chain Risk
Content: View full analysis
=4.0.0 webdriver-manager>=3.8.0 pandas>=1.3.0 wechatarticles>=0.1.0 beautifulsoup4>=4.9.0 requests>=2.25.0 openpyxl>=3.0.0 flask>=2.0.0 ``` ```python from webdriver_manager.chrome import ChromeDriverManager ``` ```python service = Service(ChromeDriverManager().install()) self.browser = webdriver.Chrome(service=service, options=chrome_options) ``` ### Technical Analysis All dependencies use open-ended lower-bound version constraints. Future package versions can therefore be installed without being represented by the audited source tree or a lockfile. This risk is especially significant for `wechatarticles`, which receives the user's authenticated WeChat cookie and token, and for `webdriver-manager`, which downloads a native ChromeDriver executable at runtime. No evidence in the reviewed code proves that these dependencies are currently malicious. The vulnerability is the absence of reproducible version and artifact controls around components that execute code or handle session credentials. ### Attack Path 1. A user installs dependencies using the provided requirements file or starts the crawler. 2. The package resolver selects a newer, compromised, or otherwise unsafe dependency version, or the driver manager retrieves a compromised driver artifact. 3. The dependency or native driver executes with the privileges of the Skill process. 4. It accesses credentials, files, network resources, or crawler data available to that process. ### Impact Assessment A successful supply-chain compromise could provide arbitrary code execution under the Skill user's account. Potential exposure includes: - WeChat tokens and cookies. - Locally stored user and queue data. - Payment transaction metadata. - Crawler ou ...[truncated 261 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (60)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code is related to WeChat Official Account article analysis and does align with the QR-login/browser interaction aspect of the description. However, the declared description prominently includes x402 micropayments and Base USDC pay-as-you-go pricing, which are not present in this code chunk. The actual code only performs keyword-based searching and ranking of articles within one specified public account via a browser-driven manager. That makes the declared purpose materially broader and partially inaccurate relative to the supplied code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The core crawling behavior does align at a high level: the script harvests recent WeChat Official Account articles from a provided list. However, significant declared features are not represented in the supplied code chunk. There is no visible x402 micropayment handling, no Base USDC pricing logic, and no explicit Chrome or QR-login flow. Instead, the code simply reads account names from accounts.xlsx and invokes a crawler manager to fetch recent articles. This makes the description materially broader/different than the observed behavior of the provided code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code does match the core idea of crawling WeChat Official Account articles by account name, so the high-level domain is aligned. However, important parts of the declared description are not represented in the supplied code chunk: there is no micropayment logic, no Base USDC integration, no browser automation, and no visible QR login handling. The script is simply a local crawler invocation for one specified account nickname with a small max_articles setting and console output. Because the description emphasizes a paid x402-enabled Chrome/QR-login crawler, while the code shown only performs basic article-history crawling, this is a material description-to-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description presents the skill as a WeChat Official Account crawler requiring Chrome and QR login, with x402 micropayments. This code chunk does not implement crawling behavior directly; instead, it manages queued crawl tasks, tracks payment status, runs a background worker, retries failures, stores tasks on disk, and emits notifications. While this could support the broader product, the actual code's primary purpose in this chunk is asynchronous task orchestration, not WeChat article crawling or browser-based login. It also does not show explicit x402/Base USDC protocol logic, only generic payment metadata handling. Because the chunk's main behavior materially differs from the declared purpose, this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description centers on a WeChat Official Account crawler requiring Chrome and interactive QR login to harvest articles, with x402 micropayments as part of pricing. The supplied code does not crawl WeChat, automate a browser, log into WeChat, or extract articles. Instead, it is a standalone Base-chain verifier that checks on-chain USDC transfers using RPC and BaseScan APIs. While payment verification could be a supporting component in a larger x402 system, this code chunk’s actual behavior is materially different from the declared primary purpose and uses entirely different external resources. Therefore this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The core behavior does align partially with WeChat Official Account article crawling and likely authentication through the imported manager, but the declared monetization/payment aspect is not represented at all in this code chunk. There is no evidence of x402, micropayments, Base USDC pricing, billing, or payment enforcement. Instead, this chunk adds keyword scoring/ranking and Excel-driven workflow. Those additions are related to article analysis, but the missing payment capability is a material mismatch because it is a prominent part of the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied code chunk is focused on account/quota management and billing state persistence. It creates and updates local user records, tracks free quota consumption, subscription validity, and usage history, and computes pricing decisions for per-article/per-account/monthly modes. While this is tangentially related to monetization mentioned in the description, the primary declared purpose is a WeChat article crawler with Chrome and QR login requirements. None of those core behaviors appear in this code. This is a material description-to-behavior mismatch rather than a mere supporting detail gap.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code is broadly related to the declared domain: WeChat Official Account crawling with x402/Base USDC payment flows. However, key declared behavior is not represented in this code chunk. There is no Chrome automation, browser control, or QR-based WeChat login logic. Instead, the code is a CLI frontend that routes commands to backend API methods, manages user/task status, and collects payment transaction hashes for paid crawl or subscription operations. Those omissions matter because the description specifically claims browser and QR-login requirements on first use, which are unsupported here. The extra payment/subscription management is related, but the primary mismatch is that the code does not itself implement the declared direct crawler/login behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description centers on a WeChat Official Account crawler with browser-based login and pay-as-you-go article harvesting. The supplied code chunk, however, is specifically a test_payment.py script focused on validating x402 payment-related components: quota management, mock blockchain transactions, payment proof verification, async queue state changes, subscription handling, and an end-to-end billing workflow. Although the script references a 'WeChat MP Spider' in output text and includes account/article-related labels, it does not actually crawl content, launch Chrome, perform QR authentication, or interact with WeChat. Therefore the code's actual purpose is materially narrower and different from the declared skill purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description partially matches the code in that it is indeed a WeChat Official Account crawler requiring Chrome and first-use QR login. However, the code materially differs from the declared description in several ways. First, it contains substantial credential management behavior: it logs into the WeChat public platform, extracts session token/cookies, tests them, and saves them locally for reuse. That is a sensitive capability not reflected in the description. Second, beyond harvesting article links/metadata, it fetches full article content and performs keyword-based analysis/scoring, which is an additional functional purpose not stated. Third, the declared x402 micropayments/Base USDC pay-as-you-go functionality is entirely absent from the code provided—there are no payment, billing, wallet, or x402-related operations. Because a major advertised feature is missing and additional undeclared capabilities are present, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The code is broadly aligned with the core idea of a WeChat Official Account article crawler, but key parts of the declared purpose are unsupported by this chunk. The wrapper provides command-line modes for crawling articles, creating/reading an Excel account list, and invoking crawler functions. However, there is no payment logic, no x402/Base USDC integration, and no visible Chrome or QR-login handling in the supplied code. Those could exist in other files, but based only on this chunk, the description materially overstates capabilities related to payments and browser/login requirements. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description presents the skill as a WeChat article crawler with x402 micropayments as an enabling feature. However, this code chunk is entirely focused on payment infrastructure: defining payment request/proof objects, calculating prices, determining realtime vs async payment mode, generating nonces and payment headers, verifying payment proofs (including optional on-chain verification), confirming payments, and checking payment status. There is no code for accessing WeChat, controlling Chrome, authenticating via QR code, fetching or parsing articles, or any crawler logic. While x402/Base USDC micropayment support aligns with part of the description, the actual primary purpose of this code chunk is payment processing, not article crawling. That is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: This file performs outbound network access to public blockchain RPC and BaseScan endpoints, but the capability is flagged as undeclared. Undeclared network access is dangerous because it expands the skill's runtime privileges beyond what users and reviewers would expect, enabling covert external communication or policy bypass even if the current requests appear payment-related.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module implements standalone Base-chain USDC payment verification, which is materially different from the stated purpose of crawling WeChat Official Account articles. Capability drift like this is risky because unrelated financial/network logic can hide unexpected behavior, increase attack surface, and make review of the skill's true behavior much harder.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code prints extracted authentication credentials directly to stdout, including the token and a copyable cookie string. Console output is often captured in logs, terminals, CI systems, or shared environments, which can leak active session secrets and enable session hijacking.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code writes reusable token and cookie values to a Python source file on disk, creating a plaintext credential store that may be read, copied, committed, or executed later. Persisting session secrets in an importable file materially increases the chance of credential theft and unauthorized reuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: After saving credentials, the code prints full copyable token and cookie values again, compounding the disclosure risk. This makes accidental leakage to shell history, logs, screenshots, or operator transcripts much more likely and provides immediate reusable secrets to anyone with output access.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill manifest says this crawler includes x402 micropayments with pay-as-you-go Base USDC pricing, implying payment-related functionality is part of the skill's behavior. In the provided file, the documented behavior is limited to browser-based login, article crawling, Excel output, and local credential reuse, with no payment flow, billing, or micropayment-related operation described anywhere.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README instructs users that tokens and cookies are saved in a local Python file and even says not to delete it, but it does not clearly warn that these are sensitive authentication secrets. Persisting session material in an easily readable source file increases the chance of credential theft through local compromise, accidental commits, file sharing, or reuse by other local users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill description switches into Chinese and presents core usage context in that language without stating that the skill is region-specific or giving users a language choice. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The skill explicitly describes saving WeChat login tokens in weixin_credentials.py for later reuse, which is session persistence of sensitive authentication material on local disk. If stored unencrypted or with weak file permissions, theft of that file could let another local user or malware reuse the session, leading to account takeover of the WeChat session and access to crawled data.
Content: Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.
md
**"Payment expired"** - Payment requests expire after 5 minutes - Create a new crawl request ### Crawl Issues

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module description, docstrings, comments, and user-visible print messages are written in Chinese, which effectively fixes the skill's language/locale behavior. There is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-only context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The queue persists full task records to disk, including user_id and payment_proof, in a predictable local path without any access controls, encryption, minimization, or retention safeguards shown. In this skill’s context, payment-related metadata and account targets are sensitive operational data; if the host is multi-user, compromised, or logs/backups are exposed, this can leak user identifiers and transaction evidence.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file adds direct blockchain RPC and explorer API integrations that are not justified by an article-crawling workflow. Even if intended for micropayment support, embedding these accesses here creates unnecessary external communication paths and broadens the codebase with off-purpose logic that could be repurposed or abused.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.