Security audit

微信公众号文章解析器

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate article-summarization purpose, but its URL handling and installation instructions give it broader and less controlled execution/network behavior than users should accept without review.

Review before installing. Only run it on trusted WeChat article URLs, avoid automatic execution from arbitrary chat messages, and prefer a fixed install that pins playwright and cheerio. The publisher should replace substring URL checks with strict URL parsing, block redirects and subresources outside mp.weixin.qq.com, and document safe argument-array invocation instead of shell interpolation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch-wechat.js:20
Finding: Weak URL Validation Allows Arbitrary Network Requests
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:13
Finding: Unquoted User-Controlled URL in Shell Command Template
Content: View full analysis
``` ### Technical Analysis The Skill instructs an Agent to substitute a user-provided URL into a shell command without showing any quoting or argument-safe process invocation. If the Agent replaces `` directly and executes the resulting text through a shell, shell metacharacters are interpreted before `fetch-wechat.js` receives the argument. Potentially dangerous syntax includes: ```text ; command && command | command $(command) `command` > file ``` The JavaScript URL check cannot prevent this vulnerability because shell parsing and command substitution occur before Node.js validates `process.argv[2]`. Even ordinary URLs containing an ampersand can be parsed incorrectly when left unquoted. This issue depends on the hosting Agent executing the documented template through a shell with direct textual interpolation. An argument-array API that bypasses shell parsing would not be vulnerable. ### Attack Path 1. A user sends a purported WeChat URL containing shell syntax. 2. The Agent follows the Skill instruction and directly replaces `` with the supplied text. 3. The Agent executes the generated string through a command shell. 4. The shell interprets the injected operator, command substitution, or redirection. 5. The injected local command runs before, after, or instead of the Node.js parser. 6. The JavaScript hostname check provides no protection because it only runs after shell interpretation. ### Impact Assessment Successful exploitation executes commands with the same operating-system identity and privileges as the Agent process. Subject to those privileges, an attacker may be able to: - Read, modify, or delete files available to the Agent. - Access environm ...[truncated 447 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:18
Finding: Unpinned Runtime Installation and Dependency Manifest Mismatch
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill metadata says it parses WeChat articles and extracts key points, but the documented behavior invokes a Node.js script that fetches arbitrary URLs using browser automation and text extraction. This mismatch hides network access and scraping capability from reviewers and users, which can lead to unexpected external requests, broader data access than declared, and unsafe invocation patterns if the URL input is not tightly constrained.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.25.0 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High

Category: Supply Chain
Confidence: 94% confidence
Finding: The lockfile includes undici 7.25.0, and the listed advisories describe request/response desynchronization, socket reuse, queue poisoning, and potential cross-user information disclosure. For a skill that fetches remote article URLs, an HTTP client vulnerability is especially relevant because network-facing code is likely in scope, making response confusion, data leakage, or crashes more plausible than in an offline-only package.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README instructs users to run npx playwright install chromium without pinning a specific Playwright version. npx may fetch and execute package code based on the current registry state, so a future compromised or incompatible release could run unexpected code during installation. In a skill-installation context, this is more dangerous because users are encouraged to execute setup commands directly from the repository.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises automatic triggering whenever a user sends a WeChat article link, but the README does not define tighter scope constraints, consent boundaries, or validation rules. Broad trigger conditions can cause the agent to invoke browser automation on untrusted URLs too readily, increasing exposure to prompt/HTML injection, unintended browsing, or misuse when similar-looking links are supplied.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: fflate==0.8.2 — 1 advisory(ies): CVE-2026-45820 (fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archive)

Low

Category: Supply Chain
Confidence: 83% confidence
Finding: The lockfile pins fflate to 0.8.2, and the supplied advisory indicates malformed ZIP64 input can trigger an infinite loop in unzipSync. This is a real supply-chain risk because the dependency is present in the shipped dependency graph, though the practical impact depends on whether the skill or its transitive tooling ever processes attacker-controlled ZIP archives.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: The dependency version is specified with a caret range (^0.12.0), which allows newer compatible releases to be installed rather than forcing a single audited version. This can introduce supply-chain risk if an upstream release is compromised or introduces breaking/security-relevant changes, though the file itself does not show active exploitation and this is a common but weaker dependency hygiene issue.
Content: Scanner excerpt · package.json (reported line 21)May include surrounding context.
json
}, "homepage": "https://github.com/oldjie/wechat-article-parser#readme", "dependencies": { "clawhub": "^0.12.0" } }

Static analysis

No suspicious patterns detected.