WeChat Article Creator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:14 AM UTC
• Version: 1.0.0

Overview

This skill warrants review because it requests WeChat account credentials and advertises automatic draft creation, but the packaged CLI is mostly placeholder behavior and lacks clear user-controlled scoping for remote account writes.

Review before installing. Use a dedicated WeChat developer credential with the least privileges available, keep .env out of source control, and only run this in a directory where that .env is intentional. Treat it as incomplete: the CLI currently does not perform the advertised article generation or upload flow, and any future draft-upload path should require explicit user review before writing to the WeChat account.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented behavior claims search, AI article generation, formatting, and draft upload, but the analyzed implementation reportedly does not perform those functions and instead includes undeclared local .env/credential loading behavior. This mismatch is dangerous because operators may grant trust and secrets based on the declared purpose while hidden or undocumented credential-handling behavior executes in practice.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 75% confidence

Finding

The skill directly reads a .env file from the current working directory, which is a sensitive credential access pattern. In an agent environment, the working directory may be less predictable or contain attacker-influenced files, so implicit credential loading can cause the skill to consume secrets without clear operator intent.

Content

Scanner excerpt · index.js (reported line 13)May include surrounding context.

js

const https = require('https');

// 加载环境变量
const envPath = path.join(process.cwd(), '.env');
if (fs.existsSync(envPath)) {
  const envContent = fs.readFileSync(envPath, 'utf8');
  envContent.split('\n').forEach(line => {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 54)May include surrounding context.

js

});
}

// 获取微信 Access Token
async function getAccessToken() {
  if (!CONFIG.WECHAT_APPID || !CONFIG.WECHAT_SECRET) {
    throw new Error('请先配置 WECHAT_APPID 和 WECHAT_SECRET');

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states that generated content will be automatically saved to the WeChat draft box, but it does not clearly warn users that the tool performs an external write action against their connected account. This can lead to unintended publication workflow changes, storage of unreviewed AI-generated content in a production-linked system, and surprise use of authenticated API permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to place WECHAT_APPID and WECHAT_SECRET in a .env file or environment variables, but it provides no guidance on protecting, rotating, or excluding these credentials from source control and logs. This increases the risk of secret leakage, which could allow unauthorized access to the associated WeChat public account APIs and misuse of account capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares environment-variable requirements for sensitive WeChat credentials but does not define an explicit tool/permission scope. This weakens least-privilege guarantees and makes secret access implicit, which can lead to overbroad execution capabilities or accidental credential exposure in agent environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description and the body of the skill documentation instruct users exclusively in Chinese, which can amount to a language policy violation when no user opt-in or alternative language is provided. There is no indication that this skill is intentionally restricted to a Chinese-only audience for compliance or regional reasons.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language description states the skill generates WeChat public account article drafts, and the CLI help and defaults are entirely Chinese-oriented without any opt-in or alternative language choice. This can constitute a language/locale policy violation when a skill implicitly enforces one language or locale by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code automatically loads a local .env file and reads WECHAT_APPID and WECHAT_SECRET into process.env, which is access to sensitive credentials. Although there are internal comments, there is no user-facing prompt, warning, or disclosure that the skill will read credential material from the working directory.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

The code sends a request containing the WeChat AppID and Secret to an external WeChat endpoint to obtain an access token. In an agent-skill context, any outbound transmission of secrets or user-associated content to third parties is security-relevant because it crosses the local trust boundary and may occur without explicit user awareness.

Content

Scanner excerpt · index.js (reported line 60)May include surrounding context.

js

throw new Error('请先配置 WECHAT_APPID 和 WECHAT_SECRET');
  }
  
  const url = `https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${CONFIG.WECHAT_APPID}&secret=${CONFIG.WECHAT_SECRET}`;
  const data = await httpRequest(url);
  
  if (data.errcode) {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill sends credential-derived data to api.weixin.qq.com to obtain an access token, and later posts article content to the WeChat draft API. While the code has technical comments, it does not clearly warn users that content and credentials-related data are transmitted to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The draft creation function transmits article content and metadata to the external WeChat API. In this skill context, generated content may contain sensitive user-provided text, so sending it off-system without clear consent or data-handling controls can expose private or regulated information.

Content

Scanner excerpt · index.js (reported line 72)May include surrounding context.

js

// 创建微信草稿
async function createDraft(accessToken, title, content, author = 'AI助手') {
  const url = `https://api.weixin.qq.com/cgi-bin/draft/add?access_token=${accessToken}`;
  
  const article = {
    articles: [{

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a workflow of searching related content, AI summarization/analysis, beautifying layout, and saving to the WeChat draft box. However, main() only parses CLI arguments and prints status/help text; it never invokes getAccessToken(), createDraft(), any search logic, or any LLM/content-generation step.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comments explicitly say this section will call search and AI generation, creating the impression that the functional path performs those operations. In reality, the code immediately proceeds to success messaging without any implementation, which is an active contradiction between documentation intent and runtime behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language description says the skill automatically generates WeChat public-account article drafts in Chinese, which implies a fixed language/locale behavior. There is no accompanying wording indicating that users can choose another language or explicitly opt into Chinese-only output.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The dependency uses a caret range (^1.6.0), which permits automatic installation of newer minor/patch releases. In supply-chain terms this reduces build reproducibility and can unexpectedly pull in a vulnerable or malicious upstream release, especially for a network-facing library like axios.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"author": "@onWalking",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "dotenv": "^16.3.0"
  }
}

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 81% confidence

Finding

Axios has multiple known advisories, and because the manifest does not pin the installed version, it is impossible to verify from this file whether a safe or affected release will be used. This matters more in this skill's context because article generation workflows commonly fetch remote content, making an HTTP client a likely attack surface for SSRF, proxy bypass, or request/response manipulation issues if a vulnerable release is installed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The dotenv dependency is also specified with a caret range (^16.3.0), allowing non-deterministic installs across environments. While dotenv is lower risk than a networking library, unpinned dependencies still increase supply-chain exposure and make it harder to verify exactly what code is executed.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "dotenv": "^16.3.0"
  }
}

Static analysis

No suspicious patterns detected.