T09 · Insecure Skill Coding Practices
Error
- Location
scripts/parse_article.py:21- Finding
Unrestricted URL Fetching Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Silas WeChat Article Search
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent WeChat article-search purpose, but it grants broad network and persistent publishing behavior without enough scoping or user control.
Review before installing. Use it only in an environment where sending search terms and article metadata to Sogou/Serper and writing collected content to Feishu is acceptable. Avoid running it unattended until URL allowlisting, Feishu write confirmation, output-path restrictions, and dependency pinning are added.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/parse_article.py:119- Finding
User-Controlled Output Path Allows Arbitrary File Overwrite
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
SKILL.md:38- Finding
Unpinned Third-Party Dependency Installation Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
代码的主要功能是“微信公众号文章解析器”，针对已知 mp.weixin.qq.com 链接抓取并解析文章内容。这与描述中的“文章搜索与解析”只部分吻合：解析部分存在，但搜索部分——尤其是搜狗微信、新榜双源搜索和 Serper 兜底——在该代码块中完全没有体现。代码也没有调用相关搜索接口、处理搜索结果或执行来源回退逻辑。因此，该描述不能准确代表此代码块的实际行为，属于显著能力缺失型不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill describes network access, local image storage under /tmp, and document creation in an external knowledge base, but it does not declare any explicit tool scope or permission boundaries. That makes the operational trust boundary unclear and increases the chance the agent will perform outbound requests or writes without informed approval or least-privilege controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill sends search terms, article titles, and URLs to third-party services including Sogou and Serper, but the description does not warn users that their queries and possibly derived content will leave the local environment. This can expose internal research topics, sensitive keywords, or content metadata to external providers without informed consent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The skill explicitly performs outbound requests to external search services, transmitting user-supplied keywords and using a browser-like User-Agent to access third-party content. In this context, the danger is not that network use exists at all, but that it can leak sensitive research terms externally and may bypass normal access expectations or compliance review.
- Content
源1：搜狗微信（主力，零依赖）
bash curl -s "https://weixin.sogou.com/weixin?type=2&query=关键词" \ -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"用 Python 正则提取标题和链接，返回搜狗中间链接列表。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill documents automatic Feishu document creation, index updates, and local image storage, but does not prominently warn users that running it can persist fetched content to external systems and disk. This creates a data-governance risk: users may unintentionally store copyrighted, sensitive, or unreviewed third-party content in a knowledge base.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The parser fetches whatever URL is supplied on the command line without validating that it belongs to mp.weixin.qq.com or another explicitly allowed domain. In an agent context, this creates an SSRF-style primitive that could be abused to access internal services, cloud metadata endpoints, or other unintended network locations while disguising the action as article parsing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The JSON example includes a fixed Chinese query string, which can reflect a language-specific default in skill behavior or examples. If this output is used as guidance for the skill, it may imply Chinese-only operation without offering user language choice or documenting the locale constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The Accept-Language header forces zh-CN/zh as the preferred locale, which is a natural-language policy concern because the skill does not provide user opt-in or an alternative locale selection. Although the script targets WeChat articles, the file does not explicitly justify this locale constraint or make it configurable.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest description focuses on article search and parsing, while this script additionally supports persisting results to a user-selected local JSON file via --save/--output. Local file writing is not mentioned in the stated skill purpose and is an extra behavior beyond pure parsing.
- Content
Static analysis
No suspicious patterns detected.