Security audit

Wechat Articles

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly aligned with searching and reading WeChat articles, but it needs Review because it can fetch arbitrary URLs and installs unpinned external dependencies.

Install only if you are comfortable with a skill that can make outbound web requests and run a real browser. Prefer using it only with explicit mp.weixin.qq.com article URLs or clearly intended WeChat public-account searches, and consider sandboxing network access plus pinning/reviewing dependencies, especially miku-ai.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wechat_articles.py:35
Finding: Unrestricted URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned Third-Party Dependencies Create Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 代码与声明部分重合于“读取微信公众号文章 URL 内容”这一点，但声明明显更宽，包含搜索公众号文章、关键词查找、以及对文章内容进行摘要/分析/翻译等场景。当前代码块只是一个 CLI 包装器：解析 URL 和模式参数，调用 read_article，再打印结果。它没有展示任何搜索逻辑，也没有内容处理逻辑。因此描述未能准确代表该代码块的实际行为，属于能力被显著高估的描述性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 代码行为与描述部分重合于“读取 mp.weixin.qq.com 文章全文提取”这一点：它使用 Playwright 打开微信文章页面并用 BeautifulSoup 提取标题、作者和正文段落，这与读取文章内容的声明一致。但声明的核心还包括“搜索公众号文章”“按关键词查找微信内容”“帮我找公众号文章”等搜索/发现能力，而该代码完全没有搜索接口、关键词处理、索引查询或任何外部搜索资源访问。此外，描述中列出的摘要、分析、翻译更像是上层使用场景，当前代码本身并未实现这些能力。可选截图属于支持性实现细节，不构成问题。总体看，实际代码只是微信公众号文章读取模块，而不是声明中的完整搜索+读取工具，因此存在实质性描述与行为不匹配。
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description uses mandatory and expansive trigger language such as 'must use this skill' even when the user does not explicitly mention WeChat, which can force invocation in loosely related contexts. In an agent system, this can cause unintended network access, over-collection of external content, and routing away from safer or more appropriate tools based on vague matches.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares and installs networking-related packages and is explicitly designed to fetch remote content, but it does not define any explicit tool scope such as allowed domains or permissions. In an agent environment, this can enable broader-than-expected outbound access and make misuse or unintended data fetching harder to constrain or audit.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes broad phrases like '微信链接' and '公众号内容' without constraints, making accidental activation likely. Overbroad triggers are dangerous in agentic systems because they expand when the skill gains networked access, increasing the chance of unnecessary external requests and data handling.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The article-reading functions accept any URL and pass it directly to requests.get() or the Playwright reader without validating that it belongs to the intended WeChat article domains. In a skill specifically meant to fetch公众号内容, this creates an SSRF/open-fetch primitive that could be abused to access internal services, unexpected hosts, or attacker-controlled pages, especially if the agent automatically invokes the skill on pasted links.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code hard-codes Accept-Language to zh-CN,zh;q=0.9, which enforces a specific locale for fetched content. This matches the language/locale policy violation category because the file provides no opt-in, fallback, or explanation that the skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The module documentation, exception text, and printed output are all hard-coded in Chinese, with no indication that the user can opt into another language. This can violate a language/locale policy when the skill is used in broader contexts and no justification or opt-in is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code opens a remote URL with Playwright and can save a full-page screenshot to disk, but the docstring and surrounding comments do not warn that it will make an outbound network request or write a local file. Under the code-file criteria, these are safety-relevant operations that lack visible user disclosure in this file.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases "微信搜索" and "公众号搜索" are broad enough to match user requests that are not specifically about reading or extracting WeChat public account articles. This can cause the skill to activate in unintended contexts, leading to over-collection of content, incorrect tool selection, or unnecessary access to external resources when a narrower skill would be more appropriate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This Python file contains its docstring, usage instructions, and runtime messages entirely in Chinese, which imposes a specific language on users. Under the policy, a forced language is a natural-language policy issue unless the skill offers language choice or clearly documents that it is intentionally region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The docstring, argument descriptions, and runtime messages are all written in Chinese, which imposes a specific language on users without any opt-in or alternative locale support. Under the policy for natural-language violations, a skill should not force a language unless it offers a choice or clearly documents a justified locale constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.