Security audit

WeChat Article Download API

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it advertises, but it should be reviewed because it sends article URLs to a third-party API and its downloader can overwrite local files if given unsafe output names.

Install only if you are comfortable sending WeChat article URLs to down.mptext.top and storing the returned article content on disk. Use public, non-sensitive links, choose a dedicated output directory, keep basename values to simple filenames, and avoid custom API endpoints unless you trust them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_wechat_article.py:89
Finding: Path Traversal and Unrestricted Overwrite Through User-Controlled Output Basename
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_wechat_article.py:35
Finding: Unbounded Remote Response Buffering Can Exhaust Process Memory
Content: View full analysis
Remediation: View remediation
MAX_RESPONSE_BYTES: raise ValueError("Response exceeds maximum permitted size") chunks = [] total = 0 while True: chunk = resp.read(CHUNK_SIZE) if not chunk: break total += len(chunk) if total > MAX_RESPONSE_BYTES: raise ValueError("Response exceeds maximum permitted size") chunks.append(chunk) body = b"".join(chunks) ``` 4. Prefer streaming directly to a temporary file with the same cumulative limit, then atomically rename the file after a successful and complete download. This reduces peak memory usage. 5. Restrict or remove `--api-url` if arbitrary API endpoints are unnecessary. If configurability is required, enforce HTTPS and optionally allowlist trusted hostnames. 6. Apply operating-system or container resource limits as defense in depth. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README promotes use of a public API to fetch article content but does not clearly warn that article URLs and retrieved content are transmitted to a third-party service. This creates a privacy and data-governance risk because users may submit sensitive, private, or embargoed links under the assumption the processing is local or first-party.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README instructs users that they can simply provide an article link and have the AI handle it, which can encourage automatic invocation on broadly phrased content-fetching requests. In a skill ecosystem, overly broad triggering increases the chance that URLs are sent to the external service without the user clearly understanding which tool is being used or that third-party network access will occur.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill enables both outbound network access and local file writes but does not declare any explicit tool scope or permissions in the skill metadata. That makes the skill's capabilities less transparent to users and enforcement systems, increasing the risk of unintended data exfiltration to the third-party API and uncontrolled local file creation when the skill is invoked.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description and workflow do not clearly warn users that requested article data will be sent to a third-party service and that responses will be persisted to local files. This can lead users to expose sensitive or internal URLs/content to an external API without informed consent, and to leave potentially sensitive data on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script sends a user-supplied WeChat article URL to a third-party service (down.mptext.top) without any explicit warning, confirmation, or consent flow. Even if the URL is public, it may contain tracking parameters, private identifiers, or reveal user interests and operational activity to an external provider, creating a real privacy and data-sharing risk in a tool whose purpose is to fetch arbitrary article content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code hard-codes an Accept-Language header of "zh-CN,zh;q=0.9,en;q=0.8", which imposes a specific locale preference regardless of user choice. This is a natural-language locale policy concern because the skill does not offer a language or locale opt-in or document why this locale constraint is necessary.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.