jike-wechat-writer

• Outcome: Review
• Latest audit: May 29, 2026 · 9:29 PM UTC
• Version: 1.0.1

Overview

This is mostly a real WeChat article-writing helper, but it gives the agent broad permission to remember user preferences, call external services, and overwrite drafts without clear consent gates.

Review before installing. Use this only if you want a Chinese WeChat-focused writing workflow and are comfortable with the 100City API receiving search terms, URLs, prompts, and image-generation requests. Prefer setting the API key via environment variable, avoid running the key check in shared logs, and require the agent to ask before writing memory, fetching third-party URLs, generating images, or overwriting draft files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The document presents the module as a memory-reading adaptation component, but later authorizes updating persistent memory during creation. This mismatch can cause operators and users to assume the module is read-only when it actually performs stateful writes, reducing oversight and increasing the chance of unauthorized or unexpected persistence of user data.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The skill declares very broad activation criteria, including generic phrases like 'help me organize this' and even implicit contextual hints, which can cause the agent to invoke the skill when the user did not actually request WeChat article generation. This creates a prompt-routing and consent problem: the agent may apply the skill's workflow, defaults, and external API requirements to unrelated tasks, leading to unintended data handling, unnecessary tool use, or user confusion.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The skill forces a default output platform of WeChat Official Accounts whenever the user does not specify a target platform. While not a direct code-execution issue, it can override user preference and steer content format, tone, and rendering choices without explicit consent, which is especially problematic given the skill's broad activation logic.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to append inferred user interest summaries into persistent dated memory files without any requirement to obtain informed user consent, disclose retention, or limit what gets stored. This creates a privacy and data-retention risk because behavioral interests inferred from conversation can accumulate over time and be reused beyond the user's immediate request.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to persist newly learned user preferences into MEMORY.md without notifying the user or obtaining consent. This creates a privacy and transparency risk because sensitive preferences, corrections, or behavioral signals may be stored across sessions unexpectedly and later influence outputs in ways the user cannot see or control.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill explicitly instructs the agent to use file write operations, including overwriting the original file during iterations, without requiring any confirmation that the destination is safe or warning about replacing existing content. In an agentic environment, this can lead to accidental destruction of prior drafts or unintended modification of unrelated files if filenames or paths are influenced by user input or upstream context.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation conditions include broad natural-language triggers such as users asking to 'add images' or directly requesting publication, which can overlap with ordinary conversation and cause the skill to run without an explicit, scoped confirmation step. In this skill, activation leads to reading and then modifying the article file, so ambiguous triggering increases the risk of unintended file changes and workflow transitions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow instructs the agent to overwrite the original Markdown file after replacing placeholders, but it does not require an upfront warning or explicit user approval immediately before the write. Because the skill performs content-altering file operations, this can lead to silent or unexpected modification of user documents, especially if the module was triggered implicitly or the chosen images are incorrect.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation conditions are broad enough that common user phrases like '排版一下' could trigger this module unintentionally, causing the agent to perform rendering actions the user did not clearly request. In this skill, that matters because activation can lead into follow-on behaviors such as theme selection, memory updates, and possible external style extraction workflows, expanding scope beyond simple formatting.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to automatically fetch and decompose styles from arbitrary external WeChat article links without clearly requiring advance notice or explicit consent for network access and downstream data handling. This can expose the system to untrusted remote content, create unexpected outbound requests, and cause user data or preferences to be persisted to MEMORY.md as part of the workflow.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The check command prints part or all of the API key to stdout, which can leak credentials into terminal history, logs, screenshots, CI output, or shared sessions. Even partial exposure of secrets weakens secrecy and may aid token identification, correlation, or brute-force attacks; if the key is short, the full secret may be printed outright.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instruction to persist inferred user interests from conversation into dated memory files introduces a clear natural-language data retention risk. Even if the stored content seems innocuous, accumulated topic interests can reveal profiling information about the user and may be accessed, reused, or mishandled later without the user's awareness.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.