wechat-article-reader

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:26 PM UTC
• Version:
  0.1.0

Overview

The skill appears to do the expected WeChat article-fetching work, with a documentation gap around its network access rather than evidence of harmful behavior.

Install if you want the agent to retrieve WeChat article content. Before use, confirm it only fetches URLs you provide and consider asking the publisher to add explicit network-permission metadata and allowed destinations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly performs outbound network access to fetch WeChat article content, yet no explicit permissions are declared in the manifest. That creates a transparency and governance gap: callers and policy engines cannot accurately reason about the skill’s capabilities, and the undocumented network access could be abused or expanded without clear review.

VirusTotal

66/66 vendors flagged this skill as clean.