omnipub-content-engine

• Outcome: Review
• Latest audit: Aug 21, 2026 · 6:37 AM UTC
• Version: 2.0.0

Overview

This is a coherent content publishing skill, but it needs review because it handles publishing credentials and public-posting workflows while exposing token material and a local credential path.

Review this skill before installing if you will connect real publishing accounts. Use a dedicated low-privilege WeChat/Toutiao account where possible, keep credentials out of prompts and logs, avoid committing config.yaml, remove token-printing before real use, and test publish/delete flows on disposable drafts first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module advertises '3-source cross-validation', but the implementation only extracts numeric-looking claims and heuristically labels nearby text. This mismatch can cause users to rely on the tool for assurance it does not actually provide, leading to publication of unverified or false claims under a false sense of validation.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The code marks a claim as 'VERIFIED' merely because the surrounding article text mentions a source name from a hardcoded list, without checking whether the citation is real, relevant, or supports the claim. An attacker or careless author can trivially insert authoritative-sounding names to bypass scrutiny, causing false claims to be presented as verified.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes very broad phrases such as general content publishing and topic-discussion terms, which can cause the skill to activate in situations where the user did not intend to invoke this high-capability workflow. Because the skill can lead into publishing, automation, and credential-using actions, accidental invocation increases the chance of unintended content handling or downstream destructive actions if later steps are insufficiently gated.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs users to place sensitive publishing credentials such as WeChat AppID and AppSecret into configuration, but it does not provide a clear warning on secure storage, least-privilege handling, redaction, or avoiding accidental disclosure in prompts, logs, or generated artifacts. In a skill that performs automated publishing and API interaction, this omission raises the risk of credential leakage and account compromise.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document exposes a specific local path to a credential file used for publishing, which needlessly reveals where sensitive authentication material is stored. In an agent-skill context, this can facilitate credential discovery, misuse, or targeted exfiltration by downstream tools or prompt-injected workflows that are instructed to read local files.

Missing User Warnings

High

• Confidence: 82% confidence
• Finding: The helper deletes an existing draft before creating a replacement, and it does so automatically with no confirmation, dry-run mode, or rollback protection. If the caller passes the wrong media_id or draft creation fails afterward, content can be lost or replaced unintentionally, creating an integrity and availability risk.

Credential Access

High

• Category: Privilege Escalation

Content

2. **若存储一致但视觉不同**：不是通道问题，是微信渲染器白名单限制。把本地 HTML 用 v9 白名单清洗后，本地浏览器预览就会等于微信端效果。
     3. **若存储不一致**：检查 `Content-Type: application/json; charset=utf-8` 请求头是否缺失（会导致乱码/属性丢失）。
   - ⚠️ 若终稿已按网页标准写完（flex/grid/class/渐变/阴影），用 `scripts/wechat_compat.py` 转 table 版只能救急，且**仍有 border-radius/shadow/gradient 被忽略**，视觉上不可能 1:1。
   - 推送脚本 `wechat_publish_design.py`：draft/add 接口直接建草稿（content=清洗后的 HTML、thumb_media_id=封面、author、digest），创建成功后 draft/delete 删旧草稿；凭证存于 `C:/Users/miko/AppData/Roaming/wenyan-md/credential.json`
   - ⚠️⚠️ **编码坑（2026-08-14 实测踩过）**：
     - `draft/add` 请求**必须显式带 `headers={"Content-Type": "application/json; charset=utf-8"}`**。`requests` 的 `data` 传 bytes 时不会自动设置 Content-Type，微信服务器按错误编码解析 → 整篇（标题+正文）存储为乱码，后台显示 `ä½ çæ£è...`。
     - `draft/get` 响应 `Content-Type: text/plain` 无 charset，`requests.json()` 会按 ISO-8859-1 解码 → **即使存储正常也会显示假乱码**。验证时必须用 `resp.content.decode('utf-8')` 再 `json.loads`，不要用 `resp.json()` 判断中文。

• Confidence: 97% confidence
• Finding: credential.json

Credential Access

High

• Category: Privilege Escalation

Content

print("Error: WeChat appid and secret required. Use --appid and --secret or set in config.yaml")
        return

    # Get access token (with retry if --retry is set)
    print("Getting access token...")
    token = None
    if args.retry:

• Confidence: 93% confidence
• Finding: access token

Credential Access

High

• Category: Privilege Escalation

Content

return

    # Get access token (with retry if --retry is set)
    print("Getting access token...")
    token = None
    if args.retry:
        loop_result = push_loop(appid, secret, get_token_fn=get_access_token)

• Confidence: 93% confidence
• Finding: access token

Credential Access

High

• Category: Privilege Escalation

Content

token = get_access_token(appid, secret)

    if not token:
        print("Error: Failed to get access token. Check appid/secret.")
        return
    print(f"  Token: {token[:20]}...")

• Confidence: 98% confidence
• Finding: access token

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.