wecom-meeting

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:44 PM UTC
• Version: 1.0.0

Overview

The skill is coherent WeCom meeting-management code, but it should be reviewed carefully because it handles live organizational credentials and can expose part of an access token when its API module is run directly.

Install only if you trust the publisher and can grant a least-privilege WeCom application. Store ~/.wecom/config.json with restrictive permissions, avoid running scripts/wecom_meeting_api.py directly until token printing is removed, confirm meeting cancellations carefully, and prefer a virtual environment with pinned dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wecom_meeting_api.py:288

Finding

Partial Access Token Disclosure Through Standard Output

Content

View full analysis

Vulnerability Details

File Location: scripts/wecom_meeting_api.py, lines 288-289
Vulnerability Type: Sensitive credential disclosure through application output
Risk Level: Medium

Vulnerable Code:

python

token = meeting.get_access_token()
print(f"✅ 成功获取 access_token: {token[:20]}...")

Technical Analysis

When wecom_meeting_api.py is executed directly, it obtains a live WeCom bearer token and prints its first 20 characters to standard output. Access tokens are sensitive authentication material and should not be logged or displayed, including in truncated form.

Standard output may be retained in terminal history, CI/CD logs, agent transcripts, monitoring systems, or centralized logging infrastructure. Although the disclosed prefix alone is not demonstrated to be sufficient for authentication, it unnecessarily weakens token confidentiality and may facilitate token identification, correlation, or reconstruction when combined with another disclosure.

This behavior is not required for the declared meeting-management functionality. Confirming that token acquisition succeeded does not require exposing any portion of the token.

Attack Path

1. An operator or automated process executes python3 scripts/wecom_meeting_api.py.
2. The script reads the configured CorpID and application secret.
3. It requests a live access token from the official WeCom API.
4. The first 20 characters of the token are written to standard output.
5. Output is retained in a terminal transcript, CI log, agent conversation, or monitoring system.
6. A user with access to that output obtains partial credential material and may correlate it with other leaked token data.

Impact Assessment

The issue exposes part of a bearer credential associated with the configured WeCom application. No direct privilege escalation from the prefix alone was established. If combined with another disclosure that reveals the remaining ...[truncated 245 chars]

Remediation

View remediation

Remediation Suggestions

Remove all token content from application output:

python

token = meeting.get_access_token()
print("Access token acquired successfully")

Additional hardening measures:

• Never log complete or partial access tokens, application secrets, authorization headers, or credential-bearing URLs.
• Ensure exception and HTTP-debug logging cannot emit request query parameters.
• Add automated tests that reject output containing token values or recognizable token prefixes.
• If token exposure is suspected, invalidate or rotate the affected credentials according to WeCom's supported procedures.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:30

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 30
Vulnerability Type: Non-reproducible dependency installation
Risk Level: Low

Vulnerable Code:

bash

pip3 install requests

Technical Analysis

The installation instruction retrieves requests without a version constraint, lock file, or integrity hash. Consequently, the installed artifact depends on the package index and dependency-resolution state at installation time.

The package name is an established dependency and no typosquatting or malicious package was identified in the project. Nevertheless, the mutable installation instruction prevents reproducible review and can introduce a compromised, incompatible, or unexpectedly changed release. The risk is higher when pip is configured to use an untrusted mirror or an attacker-controlled extra package index.

Attack Path

1. A user follows the documented pip3 install requests instruction.
2. pip resolves the current package and transitive dependencies from its configured indexes.
3. An untrusted or compromised index, mirror, package release, or dependency supplies unintended code.
4. That code is installed into the user's Python environment.
5. The code executes during package installation or when the Skill imports requests.

Impact Assessment

Exploitation could provide code execution with the privileges of the account installing or running the Skill. That process may have access to ~/.wecom/config.json, allowing a compromised dependency to read the CorpID, application secret, and AgentID and transmit them externally. The reviewed project itself does not specify an attacker-controlled package source, so this is a supply-chain hardening weakness rather than evidence of an embedded malicious dependency.

Remediation

View remediation

Remediation Suggestions

• Pin requests and its transitive dependencies to reviewed versions.
• Use a lock file with cryptographic hashes, such as a hash-locked requirements file.
• Install dependencies inside a dedicated virtual environment rather than the system Python environment.
• Use a trusted package index and avoid unreviewed --extra-index-url configurations.
• Periodically update pinned versions after vulnerability and compatibility review.

Example installation workflow:

bash

python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/wecom_meeting_api.py:43

Finding

Plaintext Credential File Without Permission Hardening

Content

View full analysis

Vulnerability Details

File Location: scripts/wecom_meeting_api.py, lines 43-47; credential setup is documented in SKILL.md, lines 35-42
Vulnerability Type: Insufficient protection of locally stored application credentials
Risk Level: Low

Credential-Loading Code:

python

config_path = Path.home() / ".wecom" / "config.json"

if config_path.exists():
    with open(config_path, 'r', encoding='utf-8') as f:
        return json.load(f)
return None

Documented Configuration:

json

{
  "corpid": "wwxxxxxxxxxxxxxxxx",
  "secret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "agentid": "1000002"
}

Technical Analysis

The Skill stores a long-lived WeCom application secret in plaintext at ~/.wecom/config.json. Plaintext configuration may be necessary where no credential store is available, but neither the code nor the documentation enforces or recommends restrictive filesystem permissions.

The loader accepts the file whenever it exists and does not warn if it is readable by the local group or other users. The actual exposure depends on how the file is created, the user's umask, filesystem access controls, and the host's threat model. No hardcoded live credential was found in the project.

Attack Path

1. A user creates ~/.wecom/config.json according to the documentation.
2. The file is created with group-readable or world-readable permissions due to the editor, file-copy process, or permissive umask.
3. Another local account or process reads the CorpID and application secret.
4. The attacker submits those credentials to the official WeCom token endpoint.
5. WeCom returns an access token subject to the application's configured permissions.
6. The attacker invokes meeting-management APIs using the compromised application identity.

Impact Assessment

A successful attacker could obtain the privileges assigned to the affected WeCom application. Within the revie ...[truncated 365 chars]

Remediation

View remediation

Remediation Suggestions

• Document creation of the configuration directory with mode 0700.
• Require the credential file to have mode 0600.
• Check file ownership and permissions before loading credentials, and reject or prominently warn about group-readable or world-readable files.
• Prefer an operating-system credential store, secret manager, or securely injected environment where practical.
• Apply least privilege to the WeCom application and grant only the meeting permissions required by this Skill.
• Rotate the application secret if unauthorized local access is suspected.

Example secure setup:

bash

install -d -m 700 "$HOME/.wecom"
install -m 600 references/config.example.json "$HOME/.wecom/config.json"

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents use of local configuration files containing CorpID/Secret and direct network access to the WeCom API, but it declares no explicit tool scope or permissions boundary. In an agent environment, this can lead to overbroad execution authority, making unintended file reads or outbound requests easier if the skill is invoked in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes meeting cancellation workflows and command examples without an explicit warning that cancellation is destructive or guidance to require user confirmation. In an autonomous or semi-autonomous agent setting, this increases the risk of accidental cancellation of legitimate business meetings, causing operational disruption.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains user-facing natural-language strings and help text only in Chinese, including the docstring, argument descriptions, examples, and prompts. The policy requires avoiding forced language or locale constraints unless the skill offers opt-in choice or clearly documents a justified region-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code presents its description, help text, examples, validation errors, and status messages entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code reads CorpID, secret, and agent ID from ~/.wecom/config.json, which is access to sensitive credentials. Although there is an internal docstring comment, there is no user-facing prompt, warning, or disclosure that the script will read local credential material automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The client sends authentication data to the WeCom API and later transmits meeting-related information over HTTP requests. The file contains technical docstrings, but no user-facing warning or disclosure that sensitive organizational data and credentials will be sent to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wecom_meeting_api.py (reported line 130)May include surrounding context.

python

}

        try:
            response = requests.post(url, json=data, timeout=10)
            result = response.json()

            if result["errcode"] == 0:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wecom_meeting_api.py (reported line 162)May include surrounding context.

python

}

        try:
            response = requests.post(url, json=data, timeout=10)
            result = response.json()

            if result["errcode"] == 0:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wecom_meeting_api.py (reported line 196)May include surrounding context.

python

}

        try:
            response = requests.post(url, json=data, timeout=10)
            result = response.json()

            if result["errcode"] == 0:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wecom_meeting_api.py (reported line 228)May include surrounding context.

python

}

        try:
            response = requests.post(url, json=data, timeout=10)
            result = response.json()

            if result["errcode"] == 0:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module test block prints the loaded CorpID, AgentID, and a prefix of the access token to stdout. Even partial token disclosure and identifier exposure can leak sensitive information into terminal history, logs, CI output, or chat transcripts, enabling credential abuse or aiding further compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes an API operation to cancel a scheduled meeting, which can affect user data and workflow, but it does not include any warning or cautionary note about the action's destructive or irreversible impact. Under the markdown-specific warning criterion, destructive behaviors should be disclosed to users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring and command usage text are written only in Chinese, and the script continues with Chinese-only user-facing descriptions and status messages. This creates a locale policy issue because the skill imposes a specific language without any opt-in, fallback, or documented justification that it is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring presents the script name, description, and usage only in Chinese, which imposes a language choice on users without offering an alternative or opt-in. The policy explicitly calls out language or locale constraints as violations when they are forced rather than optional or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Docstrings, error messages, and console output are entirely in Chinese, which imposes a specific language on users without opt-in or documented locale constraints. The stated policy requires flagging language or locale restrictions unless the skill offers choice or clearly justifies the constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.