Security audit

Wechat Article Fetch

Security checks for vulnerabilities and agentic risk

Overview

Review recommended because the skill is a coherent WeChat article fetcher, but its code can fetch any user-supplied URL rather than limiting requests to WeChat.

Install only if you are comfortable with the skill making outbound web requests from your environment. Use it only with trusted public WeChat article URLs, preferably in an isolated environment, and avoid enabling raw HTML output unless needed. A safer version should validate URLs strictly to https://mp.weixin.qq.com and use pinned dependencies.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: __init__.py:42
Finding: Server-Side Request Forgery Through Unrestricted URL Fetching
Content: View full analysis
Dict[str, any]: """ 获取微信公众号文章的完整信息 Args: url: 微信公众号文章链接 (https://mp.weixin.qq.com/s/xxx) include_raw_html: 是否包含原始 HTML Returns: 包含文章信息的字典 Example: article = fetch_article("https://mp.weixin.qq.com/s/xxx") print(article['title']) print(article['content'][:200]) """ from bs4 import BeautifulSoup import requests # 下载网页 headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36', 'Referer': 'https://mp.weixin.qq.com/', 'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8' } response = requests.get(url, headers=headers, timeout=30) ``` The metadata API contains the same vulnerable request pattern: ```python def get_article_metadata(url: str) -> Dict[str, str]: """ 获取文章元数据（不包含正文） Args: url: 微信公众号文章链接 Returns: 包含标题、作者、发布时间等信息的字典 """ from bs4 import BeautifulSoup import requests headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Referer': 'https://mp.weixin.qq.com/', } response = requests.get(url, headers=headers, timeout=30) ``` ### Technical Analysis The public APIs accept a caller-controlled `url` and pass it directly to `requests.get`. The implementation does not enforce the documented `mp.weixin.qq.com` destination, require HTTPS, restrict ports, resolve and inspect the destination IP address, or reject loopback, private, link-local, and reserved networks. Python Requests follows HTTP redirects by default. Consequently, even val ...[truncated 2142 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:78
Finding: Unpinned Runtime Dependencies Create Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation describes network-fetching behavior (requests/curl against mp.weixin.qq.com) but the manifest declares no explicit tool scope such as permissions or allowed-tools. This creates a governance gap: an agent or reviewer cannot tell from the skill manifest that external network access is required, which can lead to unintended outbound requests and weak policy enforcement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The request header forces an Accept-Language preference of zh-CN/zh, which imposes a specific locale choice in code rather than letting the user choose. This is a natural-language locale policy concern because the skill does not offer opt-in, configuration, or justification for the forced language preference.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code performs a network request to a user-provided WeChat article URL, which transmits request metadata such as headers and the user's requested target to an external service. Although the function docstring explains that it fetches article content, there is no explicit user-facing warning, confirmation, or logging around the outbound network activity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The metadata helper issues an HTTP GET request to the supplied URL, which is a safety-relevant network action because it contacts an external service using user input. The surrounding docstring describes the returned metadata but does not explicitly disclose the outbound request behavior.
Content: No source excerpt is available for this finding.