HTML to WeChat

• Outcome: Pass
• Latest audit: Jul 9, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This skill coherently helps publish user-provided HTML to a WeChat draft box, but it uses WeChat credentials, external uploads, and one runtime dependency install that users should understand first.

Install only if you intend to upload HTML and cover images to a WeChat Official Account draft box. Prefer manually installing pinned Python dependencies instead of allowing runtime pip installs, keep AppSecret out of source files and command history, use a dedicated or least-privilege WeChat account where practical, and review the draft in WeChat before publishing it publicly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
    print("[INFO] Installing Pillow...")
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "Pillow", "-q"])
    from PIL import Image

• Confidence: 94% confidence
• Finding: The script invokes pip automatically at runtime via subprocess, which expands its capabilities from local image processing to package management and potential network access. This is risky because execution behavior now depends on external package indexes, local pip configuration, and the current Python environment, creating supply-chain and unexpected code-execution exposure if a malicious or substituted package is installed.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill repeatedly instructs the agent to execute shell and Python commands, fetch remote content, and invoke companion scripts, yet the manifest declares no permissions. This creates a trust and review gap: a user or platform may approve the skill without understanding that it can run code and access external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The documented skill promises end-to-end HTML-to-WeChat publishing, but the referenced local functionality appears limited and mismatched, with meaningful behavior delegated to external companion scripts. Description/behavior mismatch is dangerous because it can hide the real operational surface from reviewers and users, especially when code execution, package installation, and external publishing are involved.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill advertises 'no web scraping' but later allows fetching arbitrary URLs to retrieve HTML. That inconsistency can mislead users about network behavior and data collection, which matters because fetching third-party URLs exposes browsing targets and potentially sensitive content to external requests.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly contradicts itself by claiming no web scraping while instructing use of WebFetch on arbitrary URLs. This is risky because users may not realize the agent will make outbound requests and ingest remote content before publication processing.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Auto-installing Pillow introduces package-management and external network behavior that is not necessary for basic image compression logic and may surprise users running the skill. In a skill intended to process user-supplied HTML/assets for WeChat publishing, this broadens the trust boundary and creates avoidable supply-chain risk if dependency resolution is influenced by a compromised index, mirror, or local environment.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill's promise is to publish content directly to a WeChat draft box, but it does not clearly warn users up front that their content and metadata will be transmitted to external WeChat services. Because this is a publishing workflow with credentials and potentially private article content, missing consent language increases the chance of unintended exfiltration or surprise side effects.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Running pip automatically without explicit advance notice or consent causes the script to modify the host environment and potentially reach out to external repositories during normal execution. This is dangerous because users may execute what appears to be a simple local utility while unknowingly permitting dependency installation, environment drift, and associated supply-chain exposure.

Unvalidated Output Injection

High

• Category: Output Handling

Content

import os, subprocess, sys
os.environ['WECHAT_APP_ID'] = '<app_id>'
os.environ['WECHAT_APP_SECRET'] = '<app_secret>'
result = subprocess.run([
    sys.executable,
    r'<anything-to-wechat_skill_dir>\scripts\publish_to_wechat.py',
    '--file', r'<workspace>\wechat_article.html',

• Confidence: 91% confidence
• Finding: The skill builds a subprocess invocation using user-derived values such as title and digest without documenting validation or sanitization requirements for the downstream script. Even though arguments are passed as a list, untrusted content is still being forwarded to a publishing script and external API, creating a risk of output/content injection, malformed requests, or unintended behavior in downstream processing.

Static analysis

No suspicious patterns detected.