Wecom

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:53 AM UTC
• Version: 1.0.3

Overview

This skill does what it advertises by sending user-provided messages to a configured WeCom webhook, but users should treat the webhook URL and sent content as sensitive.

Install only if you intend agents to post content into a WeCom group. Do not send secrets, personal data, or internal material unless that WeCom channel is approved for it, keep WECOM_WEBHOOK_URL out of logs and repositories, and prefer pinned/local dependency execution with updated packages.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (38)

Known Vulnerable Dependency: @hono/node-server==1.19.9 — 3 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode); CVE-2026-29087 (@hono/node-server has authorization bypass for protected static paths via encode)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins @hono/node-server to 1.19.9, and the cited advisories describe concrete path handling flaws in static file serving, including traversal and authorization bypass via encoded paths or repeated slashes. Because this package is a transitive dependency of the MCP SDK and is commonly used in HTTP-serving contexts, the finding is credible and could expose protected files or bypass middleware protections if the affected code paths are reachable.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.25.3 — 1 advisory(ies): CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

@modelcontextprotocol/sdk 1.25.3 is directly depended upon and the advisory indicates a cross-client data leak via shared server/transport state. In an MCP server context, that is especially relevant because the software may concurrently serve multiple clients, making unintended data disclosure between sessions a serious confidentiality issue.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

axios 1.13.4 is a direct dependency and the advisory set includes SSRF-related and prototype-pollution-gadget issues, along with other high-severity transport and request-handling risks. In an MCP/server integration context, outbound HTTP clients are often fed partially user-influenced URLs or headers, so vulnerable axios behavior can materially increase the risk of SSRF, credential leakage, or response manipulation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

fast-uri 3.1.0 is present through AJV-related dependencies and the advisories indicate URI parsing and canonicalization flaws that can cause host confusion or SSRF bypasses. When URI parsers are used in validation or policy decisions, malformed inputs may be interpreted inconsistently, undermining hostname allowlists and other network security controls.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

form-data 4.0.5 is affected by a CRLF injection issue in multipart field names and filenames, which can let attacker-controlled values alter multipart structure or inject unintended headers/content. If this server constructs multipart requests using untrusted input, the flaw can lead to request smuggling-like effects, downstream parser abuse, or security control bypasses.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.11.7 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

hono 4.11.7 is present as a peer/transitive package and the advisory set includes cookie sanitization problems, route/mount normalization issues, and other web-framework security flaws. In an MCP or HTTP server skill, framework-level routing and cookie bugs can become security-relevant because they may enable header injection, auth bypass, or incorrect route protection depending on how the framework is used.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

path-to-regexp 8.3.0 has published ReDoS/DoS issues triggered by crafted route patterns or matching behavior involving optional groups and wildcard combinations. Since this dependency is used by router components in web stacks, it can enable resource exhaustion if attacker-reachable route matching or pattern compilation hits vulnerable cases.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.25.3 — 1 advisory(ies): CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The manifest permits installation of @modelcontextprotocol/sdk version 1.25.3, which is flagged as affected by a cross-client data leak vulnerability. For an MCP server, this context is especially sensitive because the SDK may mediate transport/session state between different clients, so a shared-server leakage flaw could expose one user's prompts, tool results, or secrets to another client.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The manifest permits installation of axios 1.13.4, which is reported as affected by multiple advisories including SSRF-related proxy bypass and prototype-pollution-driven man-in-the-middle/credential theft scenarios. In an MCP server, an HTTP client is often used to call external APIs and may handle secrets or internal network access, so vulnerable request handling can materially increase risk of data exfiltration, request forgery, or traffic interception.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md

{
  "name": "wecom",
  "description": "Send messages to WeCom (企业微信) via webhooks",
  "entry": "src/index.ts",
  "commands": {
    "install": "npm install",

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

{
  "name": "wecom",
  "description": "Send messages to WeCom (企业微信) via webhooks",
  "entry": "src/index.ts",
  "commands": {
    "install": "npm install",

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · dist/index.d.ts (reported line 4)May include surrounding context.

ts

{
  "name": "wecom",
  "description": "Send messages to WeCom (企业微信) via webhooks",
  "entry": "src/index.ts",
  "commands": {
    "install": "npm install",

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · dist/index.js (reported line 4)May include surrounding context.

js

{
  "name": "wecom",
  "description": "Send messages to WeCom (企业微信) via webhooks",
  "entry": "src/index.ts",
  "commands": {
    "install": "npm install",

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · skill.json (reported line 3)May include surrounding context.

json

{
  "name": "wecom",
  "description": "Send messages to WeCom (企业微信) via webhooks",
  "entry": "src/index.ts",
  "commands": {
    "install": "npm install",

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · src/index.ts (reported line 4)May include surrounding context.

ts

{
  "name": "wecom",
  "description": "Send messages to WeCom (企业微信) via webhooks",
  "entry": "src/index.ts",
  "commands": {
    "install": "npm install",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly promotes sending message content to WeCom via incoming webhooks but does not warn that all provided content leaves the local environment and is transmitted to an external third-party endpoint. In an agent/automation context, that omission increases the risk of users routing sensitive prompts, secrets, or internal data off-platform without realizing the trust boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to set WECOM_WEBHOOK_URL but does not identify it as a sensitive credential. A leaked webhook URL can let unauthorized parties send messages into the target WeCom channel, enabling spam, phishing, social engineering, or misuse of the organization's communications infrastructure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly sends user-provided message content to an external WeCom webhook, but the documentation does not clearly warn users that data entered into the tool leaves the local environment and is transmitted to a third-party service. In an agent setting, this can cause accidental disclosure of sensitive prompts, secrets, or internal business data if users assume the tool is purely local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation instructs users to set a full WeCom webhook URL in an environment variable, but does not warn that this URL functions as a credential and should be protected from disclosure. If exposed in logs, screenshots, repos, or shared config files, an attacker could send unauthorized messages to the associated WeCom group.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This tool takes arbitrary message content from MCP callers and sends it to an external WeCom webhook without any in-band warning, consent check, or policy gating. In an agent context, that creates a real data-exfiltration path because a model or prompt chain could forward sensitive user or workspace data to a third-party service under the guise of normal tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown-sending variant has the same core issue as the text sender: user-supplied content is transmitted off-platform to WeCom with no explicit disclosure at execution time. Because markdown often contains rich copied context, reports, or logs, it can be used to exfiltrate sensitive information if invoked by an untrusted prompt or compromised workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown_v2 sender also forwards arbitrary content to an external webhook without a user-facing warning or consent boundary. Its richer formatting support can make large structured data dumps easier, increasing the usefulness of the tool for unintended data exfiltration in agent-driven environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The MCP server is launched via npx ts-node src/index.ts without pinning an exact package version. This can lead to non-reproducible execution and, in some environments, retrieval or use of an unexpected ts-node version, increasing supply-chain risk and making the runtime less trustworthy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The tool accepts arbitrary caller-supplied text and sends it to an external WeCom webhook, creating a clear data egress path from the MCP environment to a third-party service. In an agent context, this is dangerous because sensitive prompts, retrieved data, or secrets could be forwarded without an explicit user confirmation or strong policy gating.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: dist/index.js:16

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/index.ts:18