Security audit

Jisu Wechat Article

Security checks for vulnerabilities and agentic risk

Overview

This WeChat article search skill is mostly transparent, but it needs review because optional link and content fetching can make outbound requests beyond the intended Sogou/WeChat targets.

Install only in an isolated environment with restricted network access if possible. Use the normal metadata search mode by default, avoid --resolve-url and --fetch-content unless needed, and be careful with --output paths. Prefer pinned dependencies or a reviewed virtual environment before running it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:35
Finding: Unpinned Third-Party Dependencies Permit Supply-Chain Drift
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: search.py:139
Finding: Remote-Controlled URLs Can Trigger Unrestricted Outbound Requests
Content: View full analysis
Optional[str]: direct = _extract_real_from_url(url) if direct: return direct r, _ = _request_with_retry( url, timeout=timeout, allow_redirects=False, ua_candidates=ua_candidates, retries=retries, retry_delay=retry_delay, ) if not r: return None time.sleep(max(0.0, sleep_s)) loc = r.headers.get("Location", "").strip() if not loc: return None if loc.startswith("/"): loc = "https://weixin.sogou.com" + loc out = _extract_real_from_url(loc) or loc return _normalize_result_url(out) ``` Article content retrieval follows redirects automatically: ```python r, err = _request_with_retry( url, timeout=timeout, allow_redirects=True, ua_candidates=ua_candidates, retries=retries, retry_delay=retry_delay, ) ``` Search-result URLs are extracted from remote HTML without hostname validation: ```python title = _safe_text(a.get_text(" ", strip=True)) href = _normalize_result_url(a.get("href") or "") ``` Those extracted values are subsequently passed to the resolver: ```python real = _resolve_real_url( it.get("url", ""), timeout=timeout, ua_candidates=ua_cands, retries=retries, retry_delay=retry_delay, ) or "" ``` ### Technical Analysis The Skill treats links parsed from the Sogou response as request destinations. `_normalize_result_url()` only converts r ...[truncated 2992 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares executable/networked behavior, including writing output files and performing web requests, but does not declare any explicit tool scope or permissions boundary. In an agent environment, this can cause the skill to run with broader-than-expected capabilities, increasing the chance of unintended network access or filesystem writes without clear user/admin consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger description includes broad phrasing like '或类似公众号文章检索时' ('or similar'), which makes invocation boundaries ambiguous. In an agentic system, vague routing language can cause the skill to activate for loosely related requests, leading to unnecessary network activity or data handling outside the user's precise intent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is described as returning article metadata, but the implementation can also resolve real WeChat article URLs and fetch full article body text. This expands data collection beyond the declared scope, which can surprise downstream callers, increase privacy/compliance risk, and enable retrieval of copyrighted or sensitive content when only search metadata was expected.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This file’s natural-language description is entirely in Chinese, and the user-facing CLI help text is also Chinese-only. That effectively forces a specific language experience without any user opt-in or justification that the skill is intended only for a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest describes a search skill that returns article information, with no indication of local file output. The CLI supports --output and writes results to disk, which is an additional side effect beyond simply returning search results.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.