WeChat Work Notifier

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:27 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward WeChat Work notification helper, with some documentation and dependency-installation caveats but no hidden persistence, local data harvesting, or deceptive behavior found.

Install this only if you are comfortable giving the skill access to a WeChat Work webhook URL and sending selected message content to that webhook. Prefer installing dependencies in a virtual environment, and avoid committing the webhook URL because it contains a usable key.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:9

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/setup.sh, lines 9–12
Vulnerability Type: Unpinned and unverified dependency installation
Risk Level: Medium

Vulnerable Code

bash

if ! python3 -c "import requests" 2>/dev/null; then
    echo "📦 安装 requests..."
    pip install requests
fi

Technical Analysis

The setup script installs requests without a version constraint, lockfile, package hash verification, isolated environment, or explicit package-index policy. It also invokes the ambient pip executable rather than binding installation to the checked interpreter with python3 -m pip.

Consequently, the installed package and transitive dependency versions can change over time. Package resolution may also use indexes or mirrors supplied through the invoking user's pip configuration or environment. If such a source is compromised or attacker-controlled, package installation can execute attacker-supplied build or installation logic.

The audit found no evidence that this project intentionally selects a malicious package or package source. The finding concerns the unsafe dependency acquisition process.

Attack Path

1. A user runs scripts/setup.sh on a system where python3 -c "import requests" fails.
2. The script invokes the ambient pip install requests command.
3. Pip resolves the package and its dependencies using uncontrolled version selection and the environment's configured indexes or mirrors.
4. A compromised repository, malicious mirror, or manipulated pip configuration supplies an attacker-controlled distribution or dependency.
5. Pip downloads and installs that distribution.
6. Malicious build or installation code executes with the privileges of the user running the setup script.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the setup user's privileges. This could expose files, credentials, environment variables, and network access available to that user, and could mo ...[truncated 241 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare dependencies in a version-controlled requirements or lock file using audited, exact versions.
2. Generate and verify cryptographic hashes for every package and transitive dependency, then install with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Use python3 -m pip instead of the ambient pip executable so the dependency is installed for the same interpreter used by the import check.
4. Install into an isolated virtual environment rather than modifying a global or unrelated user environment.
5. Configure an approved HTTPS package index and prevent unexpected fallback to untrusted indexes or mirrors.
6. Use automated dependency scanning and a controlled process for reviewing and updating pinned versions.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose understates or ambiguously describes the skill's effective behaviors, while the implementation reportedly supports additional actions such as file sending and other message types not clearly declared. Description-to-behavior mismatches are dangerous because operators may approve or invoke the skill under a narrower trust assumption than what the code actually does, enabling unexpected data transmission or broader exfiltration paths.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill requires access to environment variables and outbound network communication to read a webhook URL and send messages, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a transparency and containment problem: an agent or reviewer cannot reliably understand or constrain what the skill is allowed to access, increasing the risk of unintended secret access or unauthorized message exfiltration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments and all user-visible messages are in Chinese, with no indication that the skill is region-specific or that other languages are unsupported. This can violate language/locale policy when a skill mandates a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This Python skill includes natural-language docstrings, CLI descriptions, and error/help text entirely in Chinese, while also containing some English identifiers. That effectively forces a specific language for user interaction without any opt-in or justification that the skill is intended only for a Chinese-speaking or region-specific environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description says the skill supports text, Markdown, card messages, and images. The code additionally implements send_file and send_template_card, which expand the skill’s actual capability beyond the declared support scope. This is a semantic mismatch because the manifest presents a narrower set of message types than the code provides.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code performs a package installation that changes the user's Python environment, but the script does not ask for confirmation before doing so. Although it prints that installation is happening, it does not clearly warn that it will modify the system or user environment.

Content

No source excerpt is available for this finding.