File to WeChat

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.1.0

Overview

The skill has a coherent WeChat publishing purpose, but it processes user documents, uses account credentials, can send content to external services, and performs unpinned runtime package installation without enough containment or confirmation.

Install only if you are comfortable letting the agent read the selected files, create derived HTML and cover images, use WeChat Official Account credentials, and upload drafts to WeChat. Review generated content before publication, avoid sensitive documents unless intended for upload, and prefer a pinned, preinstalled dependency environment with cloud fallbacks disabled unless explicitly needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/md_to_wechat_html.py:21

Finding

Unpinned Dependencies and Automatic Runtime Package Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/md_to_wechat_html.py:64

Finding

Unsanitized Markdown and Article Title Emitted into Publishable HTML

Content

View full analysis

str: """Build the article masthead.""" return f'''

{title}

''' ``` Converted Markdown is styled and inserted without a sanitization stage: ```python # Convert Markdown to HTML md = markdown.Markdown( extensions=[ TableExtension(), FencedCodeExtension(), TocExtension(), "markdown.extensions.nl2br", "markdown.extensions.sane_lists", ] ) raw_html = md.convert(md_text) # Apply WeChat styles styled_html = style_html(raw_html) # Build final document header = build_header(title) # Wrap in section (WeChat prefers

over

) final_html = f'''

{header} {styled_html}

''' ``` ### Technical Analysis The `title` value can originate from the `--title` command-line argument, the first Markdown H1 heading, or the input filename. It is inserted into an HTML text context without HTML escaping. Characters such as `<`, `>`, `&`, and quotes can therefore alter the generated document structure. The Markdown body is converted with Python-Markdown and then passed to `style_html()`. That function performs regular-expression-based st ...[truncated 2139 chars]

Remediation

View remediation

` elements, event handlers, malformed markup, dangerous URL schemes, remote image references, and nested or encoded payloads. 8. Treat all file-derived Markdown as untrusted, including content produced by third-party conversion tools. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill promises end-to-end conversion and publication of many file types, but the actual capability appears to depend on external tools and another skill for critical phases. This mismatch can cause the agent to invoke the skill under false assumptions, leading to unsafe fallbacks, accidental data handling, or unintended publishing behavior without the controls users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README promotes direct publishing to the WeChat draft box and instructs users to configure AppID/AppSecret, but it does not clearly disclose that article content and authentication-related data will be sent to an external platform. This is dangerous because users may unknowingly transmit sensitive documents or use production credentials without understanding the trust boundary and privacy implications.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill clearly instructs file reads/writes and shell execution, but it declares no tool scope or allowed-tools restrictions. That creates unnecessary ambient authority: an orchestrator may grant broader capabilities than needed, increasing the blast radius if the skill is mis-invoked or its inputs are adversarial.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The regex-style triggers are broad enough to match many ordinary requests about converting or publishing content to WeChat. Overbroad invocation increases the chance that the skill processes or publishes sensitive user content when another, narrower skill would have been more appropriate, especially because this workflow includes file conversion, shell use, and external publication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs converting user files and publishing them to WeChat, and it also mentions a cloud Markdown fallback, but it does not clearly disclose that file contents may be transmitted to external services. This is dangerous because users may provide sensitive documents under the assumption processing is local, leading to unconsented data exfiltration to third-party APIs or the WeChat platform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description and tags present the skill as specifically generating WeChat public-account articles in Chinese contexts, and the metadata explicitly includes a "chinese" tag. There is no indication that users may choose another language or locale, which can violate language/locale policy when a specific language is imposed without opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Auto-installing Python packages during document conversion is unnecessary for the skill's core function and introduces package-management behavior at runtime. This is risky because it performs networked dependency resolution and subprocess execution in the same context as handling user-supplied content, which can lead to supply-chain compromise or unpredictable system changes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

The script executes a subprocess to install a package at runtime whenever markdown is missing. In an agent skill that processes untrusted files, adding package installation and code execution capability expands the attack surface: it relies on external package indexes, permits arbitrary environment mutation, and could execute unintended code through a compromised package source or manipulated Python/pip configuration.

Content

Scanner excerpt · scripts/md_to_wechat_html.py (reported line 36)May include surrounding context.

python

except ImportError:
    print("[INFO] Installing markdown...")
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "markdown", "-q"])
    import markdown
    from markdown.extensions.tables import TableExtension
    from markdown.extensions.fenced_code import FencedCodeExtension

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Line L250 instructs the agent to tell the user a fixed Chinese message, which imposes a specific language regardless of user preference. Although the skill targets WeChat, the file also includes English descriptions and does not state that Chinese-only responses are required or offer opt-in language selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.