File to WeChat

• Outcome: Review
• Latest audit: Jul 1, 2026 · 5:16 AM UTC
• Version: 1.1.0

Overview

This skill does what it claims, but it can read broad user files and upload generated content to WeChat drafts without a clear review or consent checkpoint.

Install only if you are comfortable letting the agent read the selected files, generate derivative content, and upload it to a WeChat Official Account draft using your credentials. Review generated Markdown/HTML and cover images before publishing, avoid sensitive files unless intended, prefer local conversion over cloud fallback for private documents, and preinstall dependencies instead of relying on runtime package installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
    print("[INFO] Installing markdown...")
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "markdown", "-q"])
    import markdown
    from markdown.extensions.tables import TableExtension
    from markdown.extensions.fenced_code import FencedCodeExtension

• Confidence: 91% confidence
• Finding: The script invokes pip as a subprocess at runtime to install a dependency automatically. This expands the tool's capabilities from local document conversion into package installation and network-mediated code acquisition, which can execute unreviewed code during install and creates supply-chain and environment-tampering risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs file reads, file writes, and shell execution but does not declare permissions or present clear guardrails. This increases the chance that an agent invokes powerful operations without explicit review, especially given that it processes arbitrary user-supplied files and paths.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Automatically installing a Python package at runtime introduces package-management and subprocess execution behavior that is not necessary for a simple Markdown-to-HTML converter. In an agent skill context, this is more dangerous because the skill may run in automated environments with network access and elevated trust, turning a formatting task into one that can modify the host environment and pull remote code.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The README suggests that supplying only a bare file path is enough to invoke the skill, which can cause overly broad or accidental activation on arbitrary local files. In an agent setting, this weakens user-intent verification and increases the chance of processing or publishing sensitive local content without an explicit confirmation step.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README highlights one-click upload to the WeChat draft box but does not clearly warn that document contents and associated media will be transmitted to an external third-party service using stored credentials. In this skill’s context, that omission is more dangerous because the workflow is specifically designed to transform arbitrary files and publish them, so users may unintentionally send confidential data off-host.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The regex-style triggers are broad enough to activate on generic requests about sending or converting content for WeChat. In context, accidental invocation is risky because this skill performs file conversion and external publication, which can cause unintentional data disclosure or unwanted drafting of content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill promises to publish to the WeChat draft box automatically and explicitly says to return a published draft rather than a proposal, but it does not require a clear warning or consent before transmitting content to an external service. Because the input may be arbitrary files, this creates a real risk of exfiltrating private documents, embedded metadata, OCR'd images, or transcripts outside the local environment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script installs markdown via pip without prior approval, visibility, or policy enforcement. This can surprise operators, violate least privilege expectations, and expose the runtime to dependency-confusion, malicious package publication, or install-time code execution if package resolution is compromised.

Unvalidated Output Injection

High

• Category: Output Handling

Content

import os, subprocess, sys
os.environ['WECHAT_APP_ID'] = '<app_id>'
os.environ['WECHAT_APP_SECRET'] = '<app_secret>'
result = subprocess.run([
    sys.executable,
    r'<anything-to-wechat_skill_dir>/scripts/publish_to_wechat.py',
    '--file', r'<workspace>/wechat_article.html',

• Confidence: 91% confidence
• Finding: The skill forwards generated HTML, title, cover path, and digest into a publishing script without any trust boundary discussion or sanitization requirements. Since the pipeline converts arbitrary files and URLs into publishable content, unreviewed output could contain dangerous or policy-violating content, metadata leakage, or malformed markup that is sent directly to an external platform.

Static analysis

No suspicious patterns detected.