微信公众号文章读取器

• Outcome: Review
• Latest audit: Jul 1, 2026 · 5:05 PM UTC
• Version: 1.0.2

Overview

This skill mostly matches its WeChat article-reading purpose, but it handles full session cookies and uses an intentionally insecure network bypass client, so users should review it carefully before installing.

Install only if you are comfortable giving the skill access to WeChat public-platform session cookies and sending article/query data to third-party services. Prefer using a dedicated low-privilege account, avoid pasting full personal browser cookies, rotate or revoke cookies after use, and treat scripts/skill.env as sensitive. The no-SNI TLS bypass should be removed or replaced with normal verified HTTPS before trusting results or credentials around this skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill metadata exposes powerful capabilities via allowed-tools (exec, read, write, edit) and the documented entrypoint runs a Python script that likely uses environment variables, shell execution, and network access, but there is no clear, least-privilege permission declaration or user-facing warning about those capabilities. In an agent environment, this increases the chance of unexpected command execution, external requests, and access to local data beyond what a user would infer from the brief description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 82% confidence
• Finding: The documented behavior goes materially beyond the short description, including account intelligence, article resolution by title, comparative analysis, downloading content, and querying metadata/statistics. Most concerning, the finding notes use of a raw-socket HTTPS client without SNI to bypass anti-bot protections, which suggests deliberate evasion of service restrictions and creates legal, privacy, and abuse risk beyond a normal article reader.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file openly implements an HTTP client designed to bypass anti-crawling controls by omitting SNI and disabling certificate validation. This removes server identity verification, enables man-in-the-middle interception or redirection to attacker-controlled endpoints, and adds an evasion capability that is unnecessary for a WeChat article-reading/search skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code explicitly sets check_hostname = False and verify_mode = ssl.CERT_NONE before wrapping the socket, which disables all meaningful TLS peer authentication. An attacker on-path or controlling DNS/network routing could impersonate arbitrary hosts and supply forged responses that the skill would trust.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script loads a broad set of WeChat session cookies from skill.env and assembles them into an authenticated Cookie header, enabling the skill to act as a logged-in account. For a skill described as reading/searching articles, this is an unnecessary access pattern that expands exposure of sensitive session material and could enable account impersonation if the environment file is populated.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code calls authenticated mp.weixin.qq.com console endpoints such as searchbiz and appmsg using a session-derived token, which goes beyond simple public article retrieval. In context, this makes the skill more dangerous because it leverages account-console capabilities and authenticated state not justified by the manifest, increasing the chance of misuse, policy violations, or unauthorized account actions if cookies are compromised.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill requires a Cookie and API key but does not warn that these sensitive credentials will be transmitted to external services or may expose account/session data if mishandled. In this context, a WeChat-related Cookie can represent an authenticated session, so using it for scraping or fallback paths can create significant privacy and account-security risk if logged, leaked, or reused improperly.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The guide explicitly instructs users to export and send full WeChat platform cookies to the agent, which exposes active session credentials rather than a narrowly scoped secret. Anyone with access to those cookies and token values may be able to impersonate the user on the WeChat public platform, access account data, and perform actions until the session expires or is revoked.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly recommends fallback methods that rely on API keys and Cookies, but it provides no warning about handling sensitive credentials, session tokens, or user privacy. In a skill that fetches WeChat content, this omission can lead operators to paste personal account cookies or third-party API secrets into insecure environments, increasing risk of account takeover, data leakage, or policy violations.

Missing User Warnings

High

• Confidence: 90% confidence
• Finding: The skill performs outbound HTTPS requests using intentionally weakened TLS behavior without any disclosure or consent mechanism, despite collecting remote content from arbitrary URLs. In the context of a read/search skill, this hidden network behavior increases user and operator exposure because traffic can be intercepted or manipulated while appearing to be normal secure HTTPS.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends a locally loaded authentication cookie to remote content without any explicit user disclosure or consent flow. In this skill context, the cookie is likely tied to a WeChat session, so accidental reuse against attacker-supplied or mistyped URLs could expose account-bound credentials or session metadata to external endpoints if host validation fails or redirects are abused.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill silently uses a paid external API to download article content, which transfers user-requested URLs and possibly content to a third party without visible disclosure. In an article-reader skill, undisclosed third-party transmission raises privacy, billing, and data-governance concerns, especially if users assume all fetching is local.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The script automatically loads `skill.env` and then uses cookies/API clients for remote requests across multiple commands without any explicit user warning, consent flow, or clear indication that local credentials may be used. In an agent-skill context, this can cause unintended use of sensitive session cookies or API secrets against third-party services, increasing the risk of privacy leakage, account misuse, or surprising authenticated actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill silently loads sensitive cookie values from environment-backed storage and sends them in outgoing HTTP headers. Even though there is no direct leak to a third-party host in this file, undisclosed use of session credentials materially increases the risk of accidental exposure, misuse, and user surprise.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The instructions tell the user to provide full session material exported from the browser so the agent can reuse it in configuration, which is equivalent to transferring account-authentication artifacts. In the context of a skill that fetches WeChat article and account data, this creates a clear account-takeover and privacy risk because the agent or any downstream logs, operators, or compromised systems could reuse the session.

Ssd 2

Medium

• Confidence: 95% confidence
• Finding: The comments and module docstring explicitly describe the purpose as anti-crawling circumvention via SNI bypass. While documentation alone is not the exploit, it materially confirms the code was designed to evade service protections, which increases concern that the insecure transport behavior is intentional rather than accidental.

Ssd 2

Medium

• Confidence: 94% confidence
• Finding: The class documentation instructs use of a raw-socket, no-SNI client specifically for bypassing website protections. In this skill context, that guidance makes the capability more dangerous because the declared feature set only requires article retrieval/search, not evasion of remote defenses or insecure TLS handling.

Credential Access

High

• Category: Privilege Escalation

Content

"""
    # 加载 Cookie
    cookie = ""
    cookie_file = os.path.join(os.path.dirname(__file__), "skill.env")
    if os.path.exists(cookie_file):
        sys.path.insert(0, os.path.dirname(__file__))
        try:

• Confidence: 84% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

load_dotenv(SKILL_ENV_FILE)

# Cookie file path (now uses skill.env)
COOKIE_FILE = os.path.join(SCRIPT_DIR, "skill.env")

def load_cookie():
    """从 skill.env 加载 Cookie（按 key=value 格式存储）"""

• Confidence: 96% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

COOKIE_FILE = os.path.join(SCRIPT_DIR, "skill.env")

def load_cookie():
    """从 skill.env 加载 Cookie（按 key=value 格式存储）"""
    import os
    cookie_parts = [
        '_qimei_fingerprint', '_qimei_uuid42', 'ua_id', 'uuid', 'RK',

• Confidence: 95% confidence
• Finding: .env

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/skill.env:2

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/core/http_client.py:115