Security audit

WeChat Official Account Article Auto-Publisher

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly designed to publish WeChat Official Account articles, but it automates sensitive publishing choices without enough explicit user approval.

Review this skill before installing and only use it when you are ready for an agent to operate a live WeChat Official Account admin page. Confirm the target account, exact author, originality setting, mass notification setting, schedule, preview, and final publish action yourself before scanning any final verification QR code.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

other

Warning

Location: SKILL.md:57
Finding: Unverified Automatic Author Attribution
Content: View full analysis
kind=click # Click the author input area browser snapshot refs=aria # Confirm the author list that pops up browser act ref= kind=click # Select the first item ``` ### Technical Analysis The workflow selects the first author returned by the platform without verifying that the identity is the article's intended author. The ordering of authors in a dynamic browser interface is not a reliable authorization or identity signal. An attacker or untrusted content provider could supply an article and allow the automation to associate it with an unrelated person. The user performing the final QR-code verification may not notice the incorrect attribution, especially if the publishing confirmation does not prominently display the selected author. ### Attack Path 1. An attacker or untrusted contributor supplies article content for publication. 2. The skill opens the author selector in an authenticated WeChat Official Account session. 3. The skill automatically selects the first listed identity without asking the user to verify it. 4. The workflow proceeds through preview and publishing. 5. An administrator scans the final verification QR code without detecting the incorrect author selection. 6. The article is published under an unintended or unauthorized author identity. ### Impact Assessment The behavior does not escalate system privileges, but it can misuse the authenticated account's publishing authority. Its scope is limited to article metadata and attribution within the account being automated. Potential consequences include false attribution, reputational harm, disputes with the named author, misleading readers, and platform moderation or enforcement. ]]>
Remediation: View remediation

other

Warning

Location: SKILL.md:103
Finding: Unconditional Originality Declaration Without Rights Verification
Content: View full analysis
kind=click # Confirm the dialog browser snapshot refs=aria browser act ref= kind=click ``` ### Technical Analysis The skill unconditionally enables and confirms the platform's originality declaration. It does not establish that the user owns the content, has the necessary rights, or explicitly intends to make that declaration. An originality claim is not required for the basic publishing workflow and may constitute a rights or ownership representation. Automating it without informed confirmation can cause third-party or copied content to be falsely represented as original. ### Attack Path 1. An attacker or untrusted contributor provides copied, licensed, syndicated, or otherwise third-party content. 2. The skill enters the content into an authenticated Official Account editor. 3. The skill automatically activates the originality option. 4. The skill confirms the declaration without requesting proof of ownership or explicit user approval. 5. The administrator completes the final QR-code publishing verification without noticing the originality setting. 6. The platform receives and may publish a false originality assertion associated with the authenticated account. ### Impact Assessment The behavior can misuse the account's authority to make content-rights representations. It does not grant operating-system privileges or access outside the authenticated publishing account. Potential consequences include copyright complaints, ownership disputes, platform penalties, content removal, loss of originality-related platform privileges, and reputational or legal exposure for the account owner. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The trigger phrases are broad enough to match common requests about posting or publishing content, which can cause this high-impact browser automation skill to activate when the user did not clearly intend WeChat Official Account publication. Because the skill performs authenticated actions in a live admin backend, accidental invocation could lead to unintended drafts, publication workflows, or irreversible account actions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.