Security audit

WeChat Work Doc Fetcher

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it asks users to handle live WeChat Work session cookies in unsafe plaintext ways.

Install only if you are comfortable running a local script that contacts developer.work.weixin.qq.com using your authenticated session. Do not paste real cookies into the source file or shell history; prefer a short-lived, least-privileged session and remove or rotate cookies if they are exposed. Use a virtual environment and pinned dependency versions where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned third-party packages and browser binaries create supply-chain exposure
Content: View full analysis
Remediation: View remediation
playwright== ``` 2. Generate and verify cryptographic hashes using a lockfile or: ```bash pip install --require-hashes -r requirements.txt ``` 3. Pin and document the expected Playwright browser revision. 4. Use the official Python package index explicitly and avoid untrusted mirrors. 5. Perform installation inside a dedicated virtual environment or constrained container. 6. Add automated dependency vulnerability and integrity checks to the release process. 7. Review and update pinned versions deliberately rather than resolving mutable latest versions during installation. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:97
Finding: Authentication cookies may be exposed through source files and command-line arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill’s trigger condition is broad enough to match generic requests to 'save any page', which can cause the agent to invoke this skill in situations the user did not specifically intend. In this skill’s context, that matters because invocation can lead to authenticated browsing and retrieval of protected documentation content, increasing the chance of unintended access or mishandling of session-scoped data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation instructs users to extract and paste authenticated session cookies from browser DevTools without clearly warning that these are sensitive credentials. In this context, those cookies grant access to an authenticated developer documentation session, so copying them into script files, command lines, or agent-visible inputs creates a real risk of credential leakage, reuse, or accidental persistence in logs and history.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The user-facing documentation and usage strings are entirely in Chinese, and the script also targets a zh_CN locale in its API usage. This creates a language/locale constraint without offering opt-in or explaining that the skill is intentionally region- or language-specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script encourages users to paste live browser session cookies directly into source code and then reuses them for authenticated requests. This creates a real credential-handling risk because cookies may be accidentally committed, shared, logged, or reused beyond their intended browser context, enabling account or session compromise if exposed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README describes the skill exclusively in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy expectations when users are not given an opt-in or justification for the restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented endpoint includes lang=zh_CN, which enforces a specific locale in the skill's behavior. The file does not offer a language choice or explain why Chinese locale is required, creating a natural-language policy concern for language/locale flexibility.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The script makes POST requests to the Enterprise WeChat documentation endpoint using session cookies and a document identifier. Although network access is central to the tool's purpose, there is no explicit warning that the tool will contact the remote service using the supplied authenticated session.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.