Security audit

wxgzh

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for WeChat article publishing, but it handles a sensitive AppSecret and installs an unpinned global CLI in ways users should review carefully.

Install only if you trust the wxgzh npm package and are comfortable granting it access to your WeChat Official Account workflow. Pin or review the CLI version before installing, avoid pasting AppSecret into ordinary chat or command history when possible, restrict the config file permissions, and rotate the AppSecret if it has already appeared in logs or transcripts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:27
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:40
Finding: AppSecret Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The header's trigger scenarios are broad and unconstrained, covering publishing, credential configuration, cover generation, and Markdown conversion without clear boundaries or opt-in conditions. This increases the chance of accidental invocation in unrelated contexts, which is more dangerous here because the skill may request AppSecret values, write config files, or run external CLI commands.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition '当用户表达发布文章意图时' is overly broad and can cause the skill to activate on ambiguous requests, leading the agent to install tools or begin publication-related actions without sufficiently explicit user intent. In this skill, activation can cascade into configuration checks, package installation, and handling of publishing credentials, so misfires have meaningful security and privacy consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the user to provide AppID and AppSecret and stores them via the CLI, but does not clearly treat AppSecret as sensitive or warn about local persistence in '~/.config/wxgzh/wxgzh.json'. This creates a real risk of secret exposure through chat collection, shell history, local file compromise, backups, or accidental disclosure, especially because the secret grants access to a production publishing integration.
Content: No source excerpt is available for this finding.