T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.py:426- Finding
Arbitrary Browser Navigation Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
lh-wechat-to-markdown
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its WeChat archiving purpose, but it can open and save arbitrary URLs despite being framed as WeChat-only, which needs review before use.
Install only if you are comfortable with a Python/Playwright tool that opens URLs and writes local snapshots. Use it only with trusted WeChat article URLs, avoid passing arbitrary or third-party supplied links, consider running it in an isolated environment, and prefer pinned dependency versions before regular use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unpinned Third-Party Dependencies Create Supply-Chain Exposure
- Content
View full analysis
=1.40.0 beautifulsoup4>=4.12.0 python-frontmatter>=1.0.0 markdownify>=0.11.0 # The image-download feature depends on requests. requests>=2.28.0 ``` The dependency comment above is translated into English for report consistency; the dependency constraints are unchanged. Related installation guidance in `README.md:9` and `scripts/main.py:27` installs the packages by name without exact versions or integrity hashes: ```bash pip install playwright beautifulsoup4 python-frontmatter markdownify requests ``` ### Technical Analysis Every requirement uses a lower-bound constraint rather than an exact reviewed version. Consequently, installation may select any later release available from the configured package index. The direct `pip install` guidance is even less restrictive. The project also does not provide integrity hashes or a lock file. Installation results are therefore not reproducible and are not cryptographically tied to artifacts reviewed during this audit. This condition is not evidence that any currently named package is malicious. It is a supply-chain weakness: a compromised upstream release, compromised package-index account, unsafe configured index, or future incompatible release could be selected automatically. ### Attack Path 1. A dependency publisher account or configured package source is compromised, or an unsafe future release becomes available. 2. The malicious or vulnerable release satisfies the broad `>=` constraint. 3. A user follows the documented installation command or installs from `requirements.txt`. 4. Package installation or later import executes code from the unreviewed release with the privileges of the user running the Skill. 5. That code may access files, environment variables, browser data, network resources, and generate ...[truncated 688 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The comment documents a feature that reuses browser Cookie/Referer values to download WeChat images, which can cause authenticated session data or request metadata to be forwarded to additional endpoints without explicit user awareness or consent. In an agent skill context, borrowing browser credentials for secondary requests increases the risk of unintended authenticated access, privacy leakage, and SSRF-like abuse against resources reachable with the user's session.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code's user-facing description and CLI messages are written in Chinese throughout, starting with the module docstring and continuing across prompts and warnings. Under the policy for natural-language violations, forcing a specific language without user opt-in or justification is in scope.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency specifier uses a lower bound only, so installations may resolve to different upstream versions over time, including newly introduced vulnerable or breaking releases. For a security-sensitive automation skill, unpinned dependencies reduce reproducibility and make it difficult to verify exactly what code will execute.
- Content
text playwright>=1.40.0 beautifulsoup4>=4.12.0 python-frontmatter>=1.0.0 markdownify>=0.11.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency specifier uses a lower bound only, so installations may resolve to different upstream versions over time, including newly introduced vulnerable or breaking releases. For a security-sensitive automation skill, unpinned dependencies reduce reproducibility and make it difficult to verify exactly what code will execute.
- Content
text playwright>=1.40.0 beautifulsoup4>=4.12.0 python-frontmatter>=1.0.0 markdownify>=0.11.0 # `--download-images` 依赖 requests，并会复用浏览器 Cookie/Referer 下载微信图片
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency specifier uses a lower bound only, so installations may resolve to different upstream versions over time, including newly introduced vulnerable or breaking releases. For a security-sensitive automation skill, unpinned dependencies reduce reproducibility and make it difficult to verify exactly what code will execute.
- Content
text playwright>=1.40.0 beautifulsoup4>=4.12.0 python-frontmatter>=1.0.0 markdownify>=0.11.0 # `--download-images` 依赖 requests，并会复用浏览器 Cookie/Referer 下载微信图片 requests>=2.28.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency specifier uses a lower bound only, so installations may resolve to different upstream versions over time, including newly introduced vulnerable or breaking releases. For a security-sensitive automation skill, unpinned dependencies reduce reproducibility and make it difficult to verify exactly what code will execute.
- Content
text playwright>=1.40.0 beautifulsoup4>=4.12.0 python-frontmatter>=1.0.0 markdownify>=0.11.0 # `--download-images` 依赖 requests，并会复用浏览器 Cookie/Referer 下载微信图片 requests>=2.28.0
Unverifiable Dependency: markdownify has 2 known advisory(ies) (CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo); CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 76% confidence
- Finding
The manifest does not pin the markdownify version, while advisories exist for the package, so the deployed installation could resolve to an affected release without visibility. Although this file alone does not prove exploitation, the inability to verify a safe version is a real supply-chain hygiene weakness.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency specifier uses a lower bound only, so installations may resolve to different upstream versions over time, including newly introduced vulnerable or breaking releases. This is slightly more concerning here because requests is used alongside a documented feature that may reuse browser auth context, making exact version control more important.
- Content
text python-frontmatter>=1.0.0 markdownify>=0.11.0 # `--download-images` 依赖 requests，并会复用浏览器 Cookie/Referer 下载微信图片 requests>=2.28.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 81% confidence
- Finding
The manifest does not pin requests to a known safe version despite multiple published advisories, so installations may select a vulnerable build. Because this skill may perform authenticated HTTP downloads and reuse browser-derived request context, a vulnerable HTTP client could amplify credential leakage, SSRF, or redirect-handling issues.
- Content
Static analysis
No suspicious patterns detected.