Security audit

YouMind WeChat

Security checks across malware telemetry and agentic risk

Overview

This is a real WeChat publishing helper, but it needs Review because it can automatically write to a connected WeChat draft box and includes broad YouMind account actions without strong confirmation boundaries.

Install only if you are comfortable giving the skill a YouMind API key and letting it upload article content, prompts, images, and metadata to YouMind/WeChat. Treat publish actions as remote account changes: review the target account and draft content first, avoid confidential drafts unless approved, and be cautious with optional Impeccable installation or any scheduled automation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill exposes meaningful capabilities through allowed tools and documented behavior—reading environment variables, filesystem access, and network/API operations—without an explicit permission model or user-facing declaration of those side effects. This increases the chance that a caller or orchestrator invokes the skill without understanding it can access local state and external services, weakening least-privilege and informed-consent boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose frames the skill as article writing/formatting/publishing, but the referenced behavior expands into trend scraping, SEO research, KB mining, history/statistics analysis, learning from edits, image generation, and article-management operations. This mismatch is dangerous because users and policy layers may authorize a seemingly narrow publishing skill while it performs substantially broader data collection, retention, and external-account actions.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The operations doc directs the agent to install and initialize an unrelated third-party skill (`pbakaus/impeccable`) during normal workflow. This expands the trust boundary and can cause unreviewed code, prompts, or capabilities to be pulled into the environment, creating a supply-chain and scope-creep risk for a skill whose primary purpose is WeChat article production.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill expands beyond article writing/publishing into client onboarding, article importing, corpus management, and playbook generation. That broader operational scope increases the chance the agent will perform higher-impact file operations and manage persistent business data without the narrower consent and review expectations users would have for a publishing skill.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The pipeline mandates publishing directly to WeChat drafts for all runs, including flows that may reasonably be interpreted as formatting-only. This removes user control over an external side effect and can cause unintended disclosure, account activity, or workflow-triggering actions without explicit consent.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documented routing says formatting/publish-only input skips to Step 7, but Step 7 always auto-publishes. That contradiction can mislead users into believing a low-risk formatting action will occur when the actual behavior performs a publish side effect, undermining informed consent.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The DSL instructs the agent to check for, offer, and potentially run `npx skills add pbakaus/impeccable --yes`, which is an external package installation unrelated to the core task of drafting and publishing WeChat articles. Allowing a content-generation skill to trigger package installation expands the trust boundary and can lead to supply-chain risk or unauthorized environment changes if the agent executes shell commands on behalf of the user.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is scoped for WeChat article drafting/publishing, but this section authorizes broad YouMind board management, document creation, note taking, search, chat, and scheduled-task automation. That scope expansion creates unnecessary capability to persist data, reorganize user content, and trigger unrelated actions on an external service, increasing the blast radius if the skill is invoked or misused.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The Chat API is described as having automatic access to multiple AI tools, including image generation, web search, and knowledge-base search, based only on message content. In a WeChat publishing skill, this introduces an overly broad delegated-execution surface where user data or prompts could trigger unintended external searches, content generation, or access to stored materials beyond what is necessary.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Scheduled task creation is unrelated to an on-demand article drafting/publishing workflow and enables persistent autonomous behavior after the immediate user request ends. That persistence can cause ongoing data processing, repeated external transmissions, and surprise actions without contemporaneous user review.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The file implements generic SEO keyword intelligence against Baidu and 360 suggestion APIs, which does not align with the declared WeChat article writing/publishing capability. In an agent-skill setting, this kind of scope drift is dangerous because it can cause the agent to perform undeclared external data collection and network activity, increasing privacy, compliance, and supply-chain risk beyond what users and reviewers expect.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code sends user-provided keywords to third-party search suggestion services for generic keyword intelligence, which is unrelated to direct WeChat publishing. Even though the requests are simple GETs, this creates undeclared external data exposure and broadens the skill from publishing into search-engine reconnaissance, making misuse or unexpected data leakage more likely in the context of an agent expected to handle article drafts.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill advertises direct publishing to a remote WeChat draft/account without clearly warning that it will modify external account content. In an agent setting, this increases the risk of unintended publication, reputational harm, or accidental account-side changes if a user does not realize the action is state-changing.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger set includes broad WeChat-related phrases that can match requests outside the user's intent to author or publish an article. In a skill with external side effects, over-broad triggering raises the risk of accidental activation, unnecessary data access, or unintended draft creation/publishing workflows.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill states that it will automatically publish to the WeChat draft box as part of its quality gates, but does not pair that behavior with a clear warning that an external account will be modified. Automatic side effects on a linked third-party account can cause accidental publication workflows, data leakage into the account, or unauthorized actions if the skill is triggered on ambiguous input.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The instruction 'Always publish to drafts' and 'do NOT ask' removes a critical consent checkpoint before performing an external-side-effect action. In context, this is more dangerous because the skill is integrated with a real WeChat Official Account and also has broad triggers, making accidental or surprise writes to the user's account more likely.

Natural-Language Policy Violations

High

Confidence: 95% confidence
Finding: The requirement for 'Zero AI-sounding text' goes beyond style guidance and can encourage concealment of AI authorship or automated assistance from end users. In a publishing skill, this creates a risk of deceptive content practices, especially if users or downstream platforms expect transparent disclosure of AI involvement.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The publish command sends article content, titles, and possibly cover images to WeChat drafts, but the reference does not explicitly warn users that local content will be transmitted to an external platform. In a skill that supports direct publishing, this omission increases the risk of users unintentionally sending sensitive drafts, client data, or embargoed content off-system.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The image-generation commands explicitly use YouMind's chat API and remote libraries/CDN, yet the reference does not warn that prompts and related generation parameters may leave the local environment. Users may include confidential campaign plans, customer data, or unpublished article themes in prompts without realizing those inputs are being sent to third-party services.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The knowledge-base commands perform search, retrieval, web search, and article saving against external YouMind services, but the documentation omits warnings that queries and article content may be transmitted to or stored by those services. Because this skill handles article drafts and research materials, the lack of disclosure can lead to unintended exposure of proprietary content, client information, or sensitive editorial plans.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The playbook hard-codes Chinese/公众号-native output paths and explicitly treats English→Chinese transcreation as a default workflow without requiring an explicit user locale or consent check. In a content-publishing skill, this can cause unintended language transformation, audience mismatch, or publishing the wrong localized version, especially when the user only asked for formatting or direct send.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The playbook instructs the agent to download third-party images and re-upload them to WeChat media infrastructure, including specific external domains, without any requirement to warn the user, verify ownership/rights, or confirm network transfer. In this skill context, that creates real data-handling and IP/compliance risk because external assets are being copied across services as part of an automated publication pipeline.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The custom-theme escalation guidance is broad and does not tightly define when theme generation should occur or what requests are out of scope. In practice, loose trigger logic can cause the agent to enter more powerful design and file-writing flows than the user intended, especially when paired with automatic detection and optional installation of external tooling.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The first-run setup instructions authorize filesystem writes, dependency installation, and configuration changes without a nearby explicit warning/confirmation step for each destructive or persistent action. This can lead to unexpected environment modification, package execution, and local credential handling in response to a simple skill trigger.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The client onboarding flow instructs the agent to create directories and files in the workspace without clearly warning the user that persistent project modifications will occur. While lower impact than package installation, it still creates unexpected state and may alter repositories or working directories without informed consent.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: toolkit/src/mermaid-processor.ts:23

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/youmind-integration.md:186

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: shared/config.example.yaml:2