Security audit

Baoyu Post To Wechat

Security checks across malware telemetry and agentic risk

Overview

This skill appears built for WeChat posting, but it needs review because it handles account credentials/browser sessions and one browser article path saves drafts even though its help implies draft-saving is optional.

Install only if you trust the publisher and need automated WeChat Official Account posting. Before use, inspect project EXTEND.md and .baoyu-skills/.env, avoid committing secrets, prefer a dedicated Chrome profile, confirm the target account, and treat browser mode as able to control Chrome, clipboard, and draft creation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent to use shell commands, read environment/config files, and send content to external services, but it declares no explicit permissions or trust boundaries. This creates a confused-deputy risk where a user or agent may invoke powerful capabilities without clear consent, review, or sandbox expectations.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: This script invokes OS automation utilities (osascript, xdotool, ydotool, PowerShell SendKeys) to send real paste keystrokes to whichever application is frontmost, or to any app name supplied via --app. That is a broader capability than posting to WeChat and can cause clipboard contents to be injected into arbitrary apps or sensitive fields, making the skill more dangerous because it operates at system scope rather than a constrained WeChat/browser context.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest describes WeChat posting via API or Chrome CDP, but this file implements generic clipboard pasting into arbitrary frontmost applications across macOS, Linux, and Windows. That mismatch matters because users and reviewers may expect a narrowly scoped publishing tool, while the actual code can interact with unrelated applications and leak or submit clipboard data in unintended places.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The library enumerates default Chrome user-data directories, reads DevToolsActivePort files, and inspects local process listings to discover and attach to already-running Chrome debugging sessions. For a skill whose stated purpose is posting to WeChat, this broad local browser-session discovery is unnecessary privilege expansion and can expose unrelated browsing context, cookies, tabs, and authenticated sessions if reused.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script launches a local `agent-browser` subprocess and uses it to open pages, inspect URLs, snapshot DOM content, execute JavaScript in the page, upload local files, and keep the browser session open. That is a materially sensitive capability because it expands the skill from simple content posting into full browser automation against an authenticated WeChat session, and the manifest description does not clearly disclose that local subprocess/browser-driving behavior to users or policy controls.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The markdown workflow shells out to `npx -y bun ... md-to-wechat.ts`, which introduces unnecessary subprocess execution and dynamic package resolution for a posting skill. If the runtime environment, PATH, registry source, or invoked tooling is tampered with, this can execute unintended code with the user's privileges and expand the attack surface well beyond simple content publication.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The image upload path accepts arbitrary `http://` and `https://` URLs and fetches them server-side before reposting to WeChat. This creates an SSRF-style primitive and can be abused to make the host contact attacker-chosen endpoints, leak network metadata, or retrieve untrusted content into the publication pipeline.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases are broad enough that the skill could activate on ambiguous mentions of WeChat posting, increasing the chance of unintended execution of file reads, credential setup, or publication workflows. In a skill that can persist files and publish externally, accidental activation materially raises risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow explicitly saves plaintext content to local markdown files and may write API credentials into project or home-directory .env files, but the skill description does not clearly warn users of this persistence. Users may unknowingly leave sensitive article drafts or secrets on disk, where they can be recovered by other tools, users, or repositories.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation describes automated interaction with the WeChat editor, including opening Chrome, navigating to the editor, pasting HTML, deleting placeholders, and inserting images, but it does not clearly warn the user that browser actions will be performed on their behalf. This can lead to unexpected modification or publication of content in a logged-in WeChat session, increasing the risk of accidental posts or unintended changes to drafts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The template and surrounding setup flow normalize storing WeChat App ID and App Secret in EXTEND.md without warning users that the file may contain sensitive credentials. In this skill context, EXTEND.md may be created inside the project tree or a user-global directory, increasing the chance of accidental source control commits, insecure sharing, or broad local exposure of long-lived secrets.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The code creates and reuses a persistent Chrome profile directory for automation without any visible disclosure or consent mechanism. Persistent profiles retain cookies, session tokens, browsing state, and cached content, so silent reuse can unintentionally preserve sensitive authentication state across runs and widen the blast radius of compromise or misuse.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code inspects existing Chrome user-data directories and corresponding debugging metadata without user-facing notice. In this skill context, that is more dangerous because the advertised task is limited to publishing to WeChat; silently probing unrelated browser profiles can access a user's broader authenticated browser environment beyond what is needed for posting.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The extension encodes user-supplied PlantUML source and constructs a URL to a remote PlantUML server, which causes diagram contents to be disclosed to a third party whenever rendering occurs. In this skill context, users may paste unpublished article material, internal architecture, or sensitive workflow details into diagrams, so silent transmission creates a real privacy and data-exfiltration risk even if it is intended functionality.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: When inline SVG mode is enabled, the code performs a fetch to retrieve SVG content from the generated PlantUML URL without any clear disclosure to the user. This creates additional silent outbound traffic and imports remote content directly into the DOM, increasing privacy exposure and making the behavior more sensitive in a content-posting skill that may process confidential drafts.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script uses system-level automation and clipboard manipulation via osascript, xdotool, and spawned helper processes, which can affect the user's live desktop session outside the target browser tab. In this skill context, that is more dangerous because the tool handles arbitrary user-provided content and images, so unexpected focus changes or clipboard overwrites could paste sensitive data into the wrong application or disrupt the user's environment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code auto-discovers and attaches to an existing Chrome DevTools session, enumerates all page targets, and reuses tabs in the user's live browser context. In this skill, that materially increases risk because the tool can inspect and control whatever authenticated browser profile is exposed on the debug port, potentially accessing unrelated tabs, cookies, and account state far beyond the single WeChat publishing workflow.

External Transmission

Medium

Category: Data Exfiltration
Content: **CRITICAL**: Always include `--theme` parameter. Never omit it, even if using `default`. Only include `--color` if explicitly set by user or EXTEND.md. **`draft/add` payload rules**: - Use endpoint: `POST https://api.weixin.qq.com/cgi-bin/draft/add?access_token=ACCESS_TOKEN` - `article_type`: `news` (default) or `newspic` - For `news`, include `thumb_media_id` (cover is required) - Always resolve and send:
Confidence: 90% confidence
Finding: The skill transmits user-provided article content and metadata to the WeChat API, which is expected functionality, but it is still an external data transfer that can expose sensitive drafts, author information, comments settings, and media if invoked unintentionally. The context makes this legitimate, yet the absence of explicit pre-send disclosure and confirmation increases the security and privacy risk.

Credential Access

High

Category: Privilege Escalation
Content: | Issue | Solution | |-------|----------| | Missing API credentials | Follow guided setup in Step 2 | | Access token error | Check if API credentials are valid and not expired | | Not logged in (browser) | First run opens browser - scan QR to log in | | Chrome not found | Set `WECHAT_BROWSER_CHROME_PATH` env var | | Title/summary missing | Use auto-generation or provide manually |
Confidence: 89% confidence
Finding: The skill guides the agent to locate, prompt for, and store WeChat AppID/AppSecret credentials, and references access tokens in troubleshooting, which means it handles sensitive secrets. Storing credentials in plaintext .env files and encouraging broad environment/file lookup increases the chance of secret exposure through local compromise, logging, accidental commits, or over-broad agent access.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/cdp.ts:51

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/check-permissions.ts:69

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/copy-to-clipboard.ts:59

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/paste-from-clipboard.ts:54

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/baoyu-chrome-cdp/src/index.test.ts:89

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/baoyu-chrome-cdp/src/index.ts:220

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/wechat-agent-browser.ts:28

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/wechat-api.ts:332

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/wechat-article.ts:96

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/vendor/baoyu-chrome-cdp/src/index.ts:97