微信公众号排版引擎

• Outcome: Review
• Latest audit: Aug 4, 2026 · 11:14 AM UTC
• Version: 1.5.0

Overview

The skill matches its WeChat formatting purpose, but it deserves Review because it processes remote and uploaded content, writes persistent theme files, and allows outdated dependency versions for risky parsers.

Review before installing if you will process untrusted images, PDFs, or brand manuals. Upgrade dependency minimums, confirm where generated files will be written, avoid sensitive brand assets in shared workspaces, and inspect generated theme/index changes before keeping them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The README asserts that validation is mandatory and cannot be bypassed, but the documented Mode B/C generation paths only state file creation and registration requirements, not an equivalent mandatory validation gate for those outputs. This creates a trust gap: operators may assume all generated artifacts are safety-checked when some paths may emit unvalidated templates that later influence HTML generation.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The validator’s optional ops-mode enforces non-technical product policy, including a mandatory copyright footer and editorial heuristics, even though the tool is presented as a formatter/validator for WeChat HTML constraints. In an agent setting, this can be used to silently coerce output branding or reject otherwise valid user content, creating integrity and policy-bypass concerns rather than a classic memory/code-execution bug.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The module docstring claims the tool checks only technical constraints, but the implementation also performs operational/editorial enforcement. This scope mismatch is dangerous because downstream agents or users may trust the validator as a neutral safety/compatibility check while it actually injects hidden business rules, enabling deceptive behavior and unauthorized output shaping.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The skill instructs writing outputs into an output/ directory but does not clearly require user confirmation before creating or overwriting files. In agent environments, silent file creation or overwrite can cause data loss, clutter workspaces, or unexpectedly persist sensitive transformed content.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill supports fetching arbitrary WeChat article URLs for style extraction without a clear upfront warning that network access will occur and that remote content will be retrieved. In practice this can expose user activity patterns, process untrusted remote HTML, and surprise users who expected a purely local formatting tool.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The eval explicitly treats phrases like “直接排 / 不用问” as signals for fully automatic execution without clarification. Those are common conversational phrases, so the skill may auto-invoke or skip confirmation in situations where the user did not intend a high-confidence formatting workflow, increasing the chance of unintended actions or misrouting. In this skill context, the danger is somewhat moderated because the domain is content formatting rather than shell/code execution, but ambiguous auto-routing still creates safety and consent problems.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The eval requires Chinese full-width punctuation in body output as a compliance condition, regardless of whether the user opted into Chinese-only typography conventions. This can override user intent, distort mixed-language or code-adjacent content, and create incorrect transformations for multilingual articles, though the impact is primarily output integrity rather than direct security compromise.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The short trigger phrases near these lines are broad enough that unrelated user requests could accidentally activate this skill. In a routing system, unintended activation can cause the agent to apply WeChat-specific formatting or style-extraction behavior in the wrong context, reducing reliability and potentially causing downstream processing of unintended URLs or content.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger set is broad but does not define strong scope boundaries for what should not invoke the skill beyond a couple of examples. This increases the chance that generic formatting or style-analysis requests are misrouted to this skill, especially because the skill supports both article formatting and style extraction from external article URLs.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger list is broad and overlaps with common user requests such as style analysis, imitation, and theme extraction, without clear guardrails on when the skill should or should not activate. In an agent setting, overbroad activation can cause the wrong skill to run on unrelated inputs, leading to unintended URL fetching, content analysis, or file-generation behavior the user did not explicitly request.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs generating a new theme file and updating a theme index, but it does not clearly warn that this creates or modifies repository files. In an automated agent workflow, silent file creation or registration can alter project state unexpectedly, overwrite existing themes, or commit derived content from untrusted sources without explicit user approval.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs generating `theme-{brand}.md`, writing preview HTML, and updating an index, but it does not tell the user that local files will be created or modified and persisted on disk. When processing uploaded brand materials, silent filesystem writes can surprise users, leave sensitive brand assets or derived metadata behind, and create unintended disclosure risk in shared workspaces or repositories.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow accepts uploaded images, PDFs, documents, and HTML and extracts brand colors, slogans, logo paths, and other identifying information, yet it provides no privacy warning about analyzing, storing, or reusing that data. Brand manuals and internal style assets may be confidential, so undisclosed extraction and retention increases the risk of exposing proprietary information or persisting sensitive data beyond the user's expectations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs saving generated HTML to `assets/theme-previews/{英文标识}.html` without any user-facing notice that this creates or overwrites persistent local files. In an agent setting, silent writes can surprise users, alter repositories unintentionally, or overwrite existing work, especially because the path is deterministic and part of the project tree.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This step directs the agent to modify `references/theme-index.md`, create a persistent theme file, and run a validation command, but it does not warn the user that repository state will be changed and commands may be executed locally. In a coding assistant context, unannounced registry edits and command execution increase the risk of unintended workspace modification and reduce the user’s ability to review changes before they happen.

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: requests==2.28.0

Known Vulnerable Dependency: pillow==9.0.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`) +7 more

Critical

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: pillow==9.0.0

VirusTotal

59/59 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.