Security audit

wechat-article-reader

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches and parses public WeChat article links, with no evidence of credential access, persistence, exfiltration, or destructive behavior.

Install this only if you want an agent to fetch public WeChat articles through the bundled script. Review the exclusive-tool wording and prefer a version that allows host-agent fallback or verification if the script fails; also expect outbound requests to mp.weixin.qq.com using browser-like headers.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:12
Finding: Exclusive Tool-Use Directives Hijack Agent Decision-Making
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to fetch external WeChat article URLs using a custom script with retry logic, but it declares no tool scope or permission boundaries. This creates an authorization gap: an agent or runtime may allow network-capable behavior without an auditable, least-privilege declaration, increasing the risk of unintended outbound requests and making review harder.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill’s user-facing description and operational instructions are entirely in Chinese, and the text uses mandatory language such as '必须' without indicating that users may interact in other languages. This can violate language/locale policy because it effectively forces a specific language without user opt-in or a documented region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The request hard-codes the Accept-Language header to "zh-CN,zh;q=0.9", which imposes a specific locale choice in the skill's behavior. The policy allows locale constraints only when the user is given a choice or the restriction is clearly documented and justified, neither of which is present in this file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.