publish-to-wechat

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

This is a coherent WeChat publishing helper with expected credential use and outbound publishing, but users should review content and dependency handling before use.

Use this only for content you are ready to send to WeChat, including any local or remote images referenced by the Markdown. Keep WECHAT_APP_SECRET out of prompts, files, logs, and shell history where possible, and consider installing a reviewed/pinned Wenyan CLI version in an isolated project or container.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Global Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- **Dependency tool**: Install `wenyan-cli` (`pnpm add -g @wenyan-md/cli`).

Technical Analysis

The documented installation command retrieves the latest available version of @wenyan-md/cli without specifying an audited version or verifying package integrity. It also installs the package globally, making its executable available across the user's environment.

Package installation can execute package lifecycle scripts, while later CLI invocation executes code supplied by the installed package. If the package, its maintainer account, or a transitive dependency is compromised, a malicious release could execute under the privileges of the user performing the installation. This is a supply-chain exposure rather than evidence that the currently published package is malicious.

Attack Path

1. An attacker compromises the package publishing account, package registry entry, or a transitive dependency.
2. The attacker publishes a malicious version that remains compatible with the unpinned package name.
3. A user follows the documented pnpm add -g @wenyan-md/cli instruction.
4. The package manager retrieves the malicious current version.
5. Malicious code runs through an installation lifecycle script or when the globally installed wenyan command is invoked.
6. The code accesses resources available to that user, potentially including WeChat credentials exported as WECHAT_APP_ID and WECHAT_APP_SECRET.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the installing or invoking user. The affected scope may include user-accessible files, environment variables, network credentials, and content submitted through the publishing workflow. A global installation ...[truncated 251 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version, for example @wenyan-md/cli@<audited-version>.
• Record and verify the package-manager lockfile and integrity metadata where the deployment model permits it.
• Prefer a project-local installation over a global installation so the dependency is isolated and reproducible.
• Review the selected release, its lifecycle scripts, and its transitive dependency tree before use.
• Install and execute the CLI as a dedicated least-privileged user or inside a restricted container.
• Expose WECHAT_APP_ID and WECHAT_APP_SECRET only to the publishing process and only for the duration required.
• Use an approved private registry or dependency allowlist when operating in a sensitive environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly enables direct publication to a third-party platform and automatic upload of local or remote images, but it does not clearly warn users that article content and referenced images will be transmitted to WeChat. In an AI-agent context, this increases the risk of unintended disclosure of sensitive drafts, internal documents, or local media because the action is outbound and potentially irreversible once published or uploaded.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation instructs users to set WECHAT_APP_ID and WECHAT_APP_SECRET but does not include guidance on protecting these credentials from logging, prompt exposure, shell history, or accidental inclusion in files. In an AI-agent workflow, missing credential-handling guidance can lead to secrets being mishandled or leaked, which could enable unauthorized publishing actions against the associated WeChat account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.