Security audit

Jisu Wechat Article

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed WeChat article search scraper with optional link resolution, article text fetching, and JSON export, with no evidence of hidden persistence, credential access, or destructive behavior.

Install only if you want a web-scraping WeChat article search tool. Use redirect resolution and content fetching deliberately, respect Sogou/WeChat terms and rate limits, and provide an output path only where creating or overwriting a JSON result file is acceptable.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documentation indicates network access and file-writing behavior via requests to external sites and optional output to local files, but no corresponding permissions are declared. This weakens transparency and policy enforcement because an orchestrator or reviewer may authorize the skill under incomplete assumptions, increasing the risk of unexpected outbound requests or filesystem modification.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is article search, but the documented behavior expands into resolving redirected links, fetching full article content, and handling anti-bot pages. That gap matters because users and hosts may consent to a low-risk search skill while actually enabling broader scraping and content retrieval behavior, which increases legal, privacy, and security exposure.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is described as returning article metadata from keyword search, but the implementation can also retrieve and return full article body text when --fetch-content is enabled. This creates a scope-expansion and data-minimization issue: callers may invoke a seemingly low-risk search skill while actually performing bulk content extraction from third-party pages, which can violate user expectations, platform policy, or copyright/compliance boundaries.

Static analysis

No suspicious patterns detected.