Security audit

Wechat Articles

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with reading WeChat articles, but its web and browser fetch paths are too broadly scoped and can write screenshots to arbitrary writable paths.

Review this skill before installing in any environment with access to private networks or important writable files. If used, restrict outbound network access to intended WeChat domains, run it as an unprivileged user in an isolated environment, avoid arbitrary screenshot paths, and pin dependencies before deployment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wechat_articles.py:36
Finding: Unrestricted Article URL Fetching Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/wechat_articles_playwright.py:12
Finding: Caller-Controlled Screenshot Path Allows Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Unpinned Third-Party Packages and Browser Artifacts Create Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This metadata overclaims capabilities such as keyword search, summary/analysis/translation coverage, and a 'complete tool' scope, while the supplied code context indicates only article extraction from a provided URL and an undeclared screenshot capability. Such overbroad claims can cause the agent to invoke the skill in situations users did not intend, expose extra functionality, and weaken reviewability because the real attack surface is obscured.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This metadata overclaims capabilities such as keyword search, summary/analysis/translation coverage, and a 'complete tool' scope, while the supplied code context indicates only article extraction from a provided URL and an undeclared screenshot capability. Such overbroad claims can cause the agent to invoke the skill in situations users did not intend, expose extra functionality, and weaken reviewability because the real attack surface is obscured.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger rules are unusually broad and explicitly mandate use of this skill for loosely defined WeChat-related requests, even when the user does not clearly ask for WeChat access. In an agent setting, mandatory broad triggers can hijack task routing, cause unnecessary network retrieval of third-party content, and override safer or more appropriate tools, making the skill more dangerous than a narrowly scoped content-reader would be.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares network-dependent behavior and installation of web-fetching/browser packages, but it does not define any explicit tool scope such as permissions or allowed-tools. In an agent environment, that means the skill can be invoked without a clearly bounded network capability contract, increasing the chance of unintended external requests or policy bypass through implicit network access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language strings exclusively in Chinese in the module docstring and CLI usage/help output. Under the policy, forcing a specific language without offering a user choice or documenting a justified region-specific constraint is a locale-policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code navigates to a remote URL with Playwright and may save a full-page screenshot to disk, which are safety-relevant operations involving network access and file writes. While the docstring documents parameters, it does not clearly warn the user that the function will contact an external site and optionally persist page content as an image.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases "微信搜索" and especially "公众号搜索" are broad and can match many ordinary requests, causing this skill to be invoked when the user did not specifically ask for WeChat public-article retrieval. In an agent system, overly generic routing can lead to unintended web access, content fetching, or incorrect tool selection, which increases the chance of privacy issues, irrelevant actions, or downstream misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring and CLI description are entirely in Chinese, and the script's user-facing messages also assume Chinese as the interaction language. The policy only allows fixed language behavior when the user is given a choice or the locale restriction is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: L044 将 HTTP 请求头中的 Accept-Language 强制设置为 "zh-CN,zh;q=0.9"，这属于自然语言/区域设置约束。文件中没有提供用户选择语言或区域的机制，也没有说明该限制为何必要，因此构成语言/locale 策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The module docstrings, function docstrings, exception text, and printed labels are all hard-coded in Chinese, with no indication that language is configurable or intentionally limited to a Chinese-only context. Per the policy, forcing a specific language without user opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.