Security audit
Security checks for vulnerabilities and agentic risk
This article-search skill needs review because it automatically starts payment setup, installs payment software when missing, and can generate unsafe HTML reports.
Keep recharge manual or require approval of the verified payee and exact amount before payment setup. Provision a reviewed, pinned payment CLI instead of allowing automatic latest-version installation. Prefer JSON output until HTML escaping and link validation are fixed. Searches use provider credits; recurring delivery is optional.
scripts/fetch_gzh_trends.pyExternal article metadata can inject scripts into HTML reports
An injected script element or event handler can execute when the report is opened, modify displayed results, present deceptive links or payment prompts, and transmit report content to an attacker-controlled endpoint. This does not establish access to local files or the API key.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
data = json.dumps(body_dict, ensure_ascii=False).encode("utf-8")
req = urllib.request.Request(url, data=data, headers=headers, method="POST")
try:
with urllib.request.urlopen(req, timeout=30) as resp:
raw = resp.read().decode("utf-8")
return json.loads(raw)
except urllib.error.HTTPError as e:
The article-search and recommendation behavior matches the description. However, the explicitly promised automatic recharge-and-resume behavior is absent from this chunk: no alipay-bot commands are executed, no payment status is polled, and no query is retried after payment. The printed workflow is output text, not executable payment integration. An external orchestrator might implement it, but none is shown. API authentication, date-range expansion, and HTML generation are supporting implementation details rather than mismatches.
The visible workflow directs automatic payment initiation on insufficient credits without requiring prior disclosure of the amount, merchant, or purchase terms. A request to search articles is not informed consent to recharge an account; the referenced payment procedure was not supplied, so any protections it might add cannot be verified.
An API-controlled error code and payment payload move the agent from information retrieval into a financial workflow without an explicit purchase-approval gate in the supplied document. This trusts external service output to initiate a higher-impact action and could enable unwanted payment attempts or misleading orders, although actual debit authorization depends on the unseen payment tools and wallet controls; this overlaps with SQP-2.
An insufficient-credit response causes tool output to instruct the agent to initiate a payment workflow using an API-supplied cashier URL, amount, and merchant description without visible validation or an explicit user-approval gate. Although automatic recharge is advertised in the metadata and this script does not itself transfer money, a search request does not establish authorization for an arbitrary payment; following these instructions could expose the user to an unwanted or misdirected payment request.
Without declared permissions the skill's intent is opaque and cannot be validated.
The description lists “获取创作灵感” (getting creative inspiration) as an activation condition alongside searching public-account articles. This can match general brainstorming requests that do not require WeChat searches, and no exclusion explicitly limits that trigger.
The workflow directs the agent to install a missing CLI automatically, and npx -y suppresses the package-execution confirmation without establishing user authorization for this environment change. Installing and executing downloaded code goes beyond an ordinary article-search request, and the payment context makes compromise particularly consequential.
The command uses @latest, allowing newly published package code to execute with the agent's local permissions without a reviewed version boundary. Although this is a CLI rather than an MCP server, the underlying supply-chain risk is real: a compromised release could access local credentials or interfere with the payment workflow.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The manifest describes article search, trend recommendations, and an insufficient-credit recharge workflow. L748 additionally advertises purchasing the provider's full database and directs users to a procurement email address after every completed query, including JSON output; this is unrelated marketing rather than a necessary implementation of the declared functions.