WeChat MP Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:20 AM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it overstates its monitoring feature and has review-worthy risks around unrestricted URL fetching and plaintext webhook storage.

Install only if you are comfortable with a demo-level tool that does not actually monitor WeChat accounts yet. Run it in an isolated environment, provide only trusted WeChat article URLs, avoid using the command-line webhook option, prefer a protected environment variable for Feishu, and review or delete ~/.wechat_mp_monitor if it may contain sensitive history or webhook data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wechat_mp.py:70

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wechat_mp.py:153

Finding

Feishu Webhook Credentials Are Accepted Through the Command Line and Stored in Plaintext

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:87

Finding

Third-Party Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tainted flow: 'webhook' from os.environ.get (line 117, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/wechat_mp.py (reported line 140)May include surrounding context.

python

}
    
    try:
        response = requests.post(webhook, json=payload, timeout=10)
        result = response.json()
        if result.get('code') == 0:
            print("✓ Feishu 通知已发送")

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description overstates the implemented functionality. The code does support article summarization for a provided WeChat article URL, local persistence of a watchlist/history, and a Feishu webhook notification helper. But the core declared purpose—monitoring public accounts for updates and alerting on newly published content—is not actually implemented. The check_all() function explicitly states it is a demo version and requires RSS/API support, then only prints placeholder status. There is also no built-in scheduling or cron setup logic; at most, the script could be run externally by cron, but that is not implemented in the code itself. Therefore the declared description does not accurately represent the code's actual behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises commands that read environment variables, access local files under the user's home directory, and make outbound network requests, but it does not declare any explicit tool scope or permissions. That creates a transparency and least-privilege problem: a user or hosting platform cannot easily constrain what the skill is allowed to access, increasing the chance of unintended secret exposure, filesystem modification, or external data transmission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The top-level docstring says the script 'Monitors public accounts and sends notifications,' and the CLI advertises check-all as checking all accounts. In contrast, check_all() prints that this is a demonstration version and that users must manually provide article URLs, which directly contradicts the stated behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The notification body is always constructed under the zh_cn locale key, which forces a specific language/locale in user-facing output. The file does not offer a user opt-in, alternate locale selection, or a documented region-specific justification for this constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/wechat_mp.py (reported line 140)May include surrounding context.

python

}
    
    try:
        response = requests.post(webhook, json=payload, timeout=10)
        result = response.json()
        if result.get('code') == 0:
            print("✓ Feishu 通知已发送")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes scheduled monitoring of WeChat MP accounts and notifications for new published content. However, check_all() merely prints that a full implementation would require RSS/API support and marks each account as pending, so the core monitoring behavior is not actually implemented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill stores watchlists and history in persistent files under the user's home directory without clearly warning about that behavior in the description. While not severe on its own, undisclosed persistence can expose reading habits, monitored targets, or article history on shared systems and weakens informed consent around local data handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.