Security audit

Another WeChat Article Reader

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with reading public WeChat articles, but its setup and fallback script create risks that should be reviewed before installation.

Install only if you are comfortable with local command execution and network fetching. Prefer installing uv through a trusted package manager, use a reviewed lockfile, and avoid running the diagnostic script on anything except intended public WeChat article URLs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:35
Finding: Unverified Remote Installer Is Downloaded and Executed by a Shell
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:13
Finding: Skill Documentation Attempts to Override Agent Tool Selection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wechat_js_render.py:170
Finding: Diagnostic Fetcher Permits Requests to Arbitrary and Internal Hosts
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: pyproject.toml:7
Finding: Dependency Resolution Is Mutable and Not Protected by a Lockfile
Content: View full analysis
=0.7", "beautifulsoup4>=4.12", ] ``` The documented installation command in `SKILL.md:40-43` is: ```bash uv sync ``` No dependency lockfile is present in the audited project. ### Technical Analysis Both dependencies use open-ended lower-bound constraints. Consequently, a future `uv sync` can resolve package versions that did not exist and were not reviewed when this Skill was published. The package names correspond to ordinary public packages, and the audit did not identify typosquatting, dependency confusion, or a currently malicious dependency. The confirmed weakness is the absence of reproducible dependency resolution and integrity pinning. If an upstream release or publisher account is compromised, later installations can receive altered package code without any change to this repository. Because third-party Python packages are installed into the execution environment and imported by the scripts, a compromised package can execute code with the current user's permissions. ### Attack Path 1. A future release of an allowed dependency is compromised or maliciously published. 2. A user or Agent runs `uv sync`. 3. The lower-bound constraints permit resolution to the compromised release. 4. The package is installed without comparison against a repository-reviewed lockfile. 5. Malicious package behavior executes during installation or when imported by the article reader. ### Impact Assessment A compromised dependency could obtain arbitrary code execution with the privileges of the user running `uv sync` or the Skill. This may permit access to user-readable files, environment variables, project data, and reachable network services. No evidence was found that the currently declared packages are malicious. The risk arises from mutable f ...[truncated 69 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Using a shell pipeline to execute downloaded content directly is a classic chaining-abuse pattern because it combines retrieval and execution in one step, eliminating an opportunity for inspection or integrity checks. In a skill setup context, this increases the chance that users will blindly run attacker-controlled or tampered installer code.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
若 uv 未安装，先执行：

bash
brew install uv # macOS；Linux 用 curl -LsSf https://astral.sh/uv/install.sh | sh

再安装项目依赖：

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill directs the agent to perform network-backed article retrieval but does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity where the agent may use broader capabilities than intended, increasing the risk of unintended network access or policy bypass in environments that rely on manifest-level scoping.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description is written as a strict behavioral instruction and presents the skill's operation entirely in Chinese without any indication that users may request another language. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The request headers hard-code Accept-Language: zh-CN,zh;q=0.9,en;q=0.8, which imposes a specific locale preference on all requests. This is a natural-language/locale policy issue because the script does not offer user opt-in or explain why a Chinese locale is required.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: The instructions recommend installing uv via a remote shell pipeline (curl ... | sh), which executes code fetched from the network without prior verification. If the remote host, transport, or install script is compromised, an operator running the setup command could execute arbitrary code on the host.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
若 uv 未安装，先执行：

bash
brew install uv # macOS；Linux 用 curl -LsSf https://astral.sh/uv/install.sh | sh

再安装项目依赖：

Unverifiable Dependency: curl_cffi has 3 known advisory(ies) (GHSA-3vpc-4p9p-47hc (curl_cffi bundles a version of libcurl affected by High Severity vulnerability); CVE-2026-33752 (curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (wi); CVE-2026-33752 (curl_cffi: Redirect-based SSRF leads to internal network access in curl_cffi (wi)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The project declares curl_cffi with only a minimum version constraint, so dependency resolution may install a release affected by known advisories, including a bundled libcurl issue and a redirect-based SSRF flaw. In this skill's context, the package is used to fetch attacker-controlled WeChat URLs, which increases risk because network-facing behavior and redirect handling are central to the skill's operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The request hard-codes Accept-Language: zh-CN,zh;q=0.9, which imposes a specific language/locale behavior. Under the policy, forcing a locale without user opt-in or clear region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.