WeChat Article Scraper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:47 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated WeChat archiving purpose, but its downloader can fetch arbitrary web or internal URLs instead of enforcing a WeChat-only boundary.

Review before installing in any environment with access to private networks or sensitive internal services. Use only trusted WeChat short URLs, run in a sandboxed environment with restricted outbound networking, and prefer pinned dependencies or a lockfile.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/download_wechat_articles.py:387

Finding

Unrestricted article and image URL fetching enables server-side request forgery

Content

View full analysis

= min_size: with open(save_path, "wb") as f: f.write(resp.content) return True ``` A second unrestricted request is issued to the image URL when determining its content type: ```python try: resp_head = requests.head(img_url, headers=HEADERS, timeout=10) ct = resp_head.headers.get("Content-Type", "") correct_ext = extract_image_extension(img_url, ct) ``` ### Technical Analysis The Skill is documented as a downloader for articles hosted on `mp.weixin.qq.com`, ...[truncated 3565 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs the agent to install packages, read a user-supplied URL list, fetch remote content from the network, and write downloaded articles and images to disk, but it declares no explicit tool scope or permission boundaries. Without scoped permissions, an agent runtime may grant broader file and network access than necessary, increasing the risk of unintended data access, SSRF-like fetching of arbitrary URLs if validation is weak, or unsafe writes outside the intended workspace.

Content

No source excerpt is available for this finding.

Tainted flow: 'filepath' from requests.get (line 482, network input) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/download_wechat_articles.py (reported line 484)May include surrounding context.

python

filename = f"{idx:02d}-{date_str}_{sanitize_filename(result['title'])}.md"
        filepath = os.path.join(output_dir, filename)

        with open(filepath, "w", encoding="utf-8") as f:
            f.write(result["md_content"])

        date_display = date_str if date_str != "unknown-date" else "unknown-date (check manually)"

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 7)May include surrounding context.

text

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency specifier for requests is unpinned, allowing installation of different future versions across environments and over time. This weakens build reproducibility and can unintentionally introduce vulnerable or breaking releases, especially for a network-facing scraper that fetches remote content.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28.0
beautifulsoup4>=4.11.0
lxml>=4.9.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

Requests has multiple published advisories, and because the manifest does not pin a version, there is no way to verify that installations will avoid affected releases. In a scraper that makes outbound HTTP requests to attacker-controlled or untrusted URLs, advisory exposure is more relevant than in an offline-only package.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The beautifulsoup4 dependency is not pinned to an exact version, so installations may resolve to different releases depending on when and where the skill is installed. This creates supply-chain and reproducibility risk, even if no specific exploit is evident from this file alone.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.28.0
beautifulsoup4>=4.11.0
lxml>=4.9.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The lxml dependency is unpinned, which is riskier than many pure-Python packages because it is a complex parser with a history of security issues. Allowing arbitrary newer matching versions can lead to inconsistent and potentially vulnerable parser behavior in a tool that processes untrusted remote HTML.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.28.0
beautifulsoup4>=4.11.0
lxml>=4.9.0

Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Lxml has a meaningful history of parser-related security issues, and the unpinned requirement prevents verification that a safe release will be installed. Because this skill scrapes and parses external WeChat article HTML, an unsafe lxml version could increase exposure to malformed-content or parser-triggered attacks.

Content

No source excerpt is available for this finding.