Security audit

Weiwuming Formatter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real WeChat formatter, but it automatically uses web lookups, rehosts images to a public service, and injects fixed publication branding and reviewer text into every output.

Install only if you specifically want the 谓无名 WeChat publication workflow, including its fixed footer/reviewer convention and public image-hosting behavior. Do not use it on confidential drafts, private image links, unpublished media, or content where added branding/attribution would be inappropriate unless the workflow is changed to ask before web searches and uploads.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: skill.md:133
Finding: Mandatory Promotional Content and Attribution Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/extract_docx.py:70
Finding: Unbounded Decompression and XML Parsing of Uploaded DOCX Files
Content: View full analysis
ET.Element | None: try: return ET.fromstring(zf.read(name)) except KeyError: return None ``` The parser invokes this function on an uploaded ZIP-based DOCX package without first applying archive limits: ```python def parse_document(path: Path) -> dict[str, Any]: with zipfile.ZipFile(path) as zf: document = read_xml(zf, "word/document.xml") if document is None: raise RuntimeError("word/document.xml not found; this is not a valid .docx package.") styles = load_styles(zf) rels = load_relationships(zf, "word/document.xml") body = document.find("w:body", NS) if body is None: raise RuntimeError("word/document.xml has no body.") content: list[dict[str, Any]] = [] paragraphs: list[dict[str, Any]] = [] tables: list[dict[str, Any]] = [] images_in_flow: list[dict[str, Any]] = [] for index, child in enumerate(list(body)): if child.tag == qn("w:p"): item = parse_paragraph(child, index, styles, rels) content.append(item) paragraphs.append(item) images_in_flow.extend(item["images"]) elif child.tag == qn("w:tbl"): item = parse_table(child, index, styles, rels) content.append(item) tables.append(item) for row in item["cells"]: for cell in row: for para in cell: images_in_flow.extend(para["images"]) ``` ### Technical Analysis A DOCX file is a ZIP archive containing XML members. The `read_xml` function calls `zf ...[truncated 2422 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/syntax_rules.md (reported line 1)May include surrounding context.
md
--- name: wechat-formatter description: | Convert uploaded .doc/.docx files or pasted text into WeChat article markdown using the "谓无名" editor syntax.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · skill.md (reported line 1)May include surrounding context.
md
--- name: wechat-formatter description: | Convert uploaded .doc/.docx files or pasted text into WeChat article markdown using the "谓无名" editor syntax.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill description and rules direct the agent to upload images to a public host, but they do not require an explicit up-front user warning or consent at the point of use. A user may provide a private manuscript or embedded images without realizing that source-derived media will be republished to a public URL.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This instruction explicitly requires publishing uploaded or source-derived images to a public image host and inserting the returned public URLs into the output. If the document contains sensitive, copyrighted, personal, or unpublished material, the workflow can disclose that content outside the user's environment without meaningful consent controls.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: These steps operationalize a repeated download-and-republish pipeline to a public host, expanding the exposure surface and normalizing exfiltration of media gathered from the source document or web searches. The repeated instructions to persist files locally, upload them externally, and reuse returned URLs make accidental data leakage more likely and harder for users to notice.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow mandates taking source-provided hosted images, downloading them, re-uploading them to another public host, and then reporting those public links back. This can republish content in ways the original source or user did not authorize, and it creates an unnecessary disclosure trail in the final response.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instructions require the 编者按 to be written in Chinese and prescribe a specific editorial tone, and later validation requires it for every article. This is a natural-language locale constraint that does not present any user opt-in or justified region-specific limitation in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The follow section contains fixed Chinese text and the rules say it is mandatory for every article and must not be modified. This enforces a specific language/locale without offering choice or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: With no manifest available, the only stated purpose comes from the module docstring: extracting structured content from Word documents. Spawning LibreOffice via subprocess is a materially broader capability than in-process parsing, because it executes an external program on attacker-controlled input rather than only reading the document structure directly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad enough that the skill may activate for general document formatting or article-writing requests that do not clearly imply the user's intent to use this specific workflow. That increases the chance the agent will apply invasive behaviors such as web searching and image handling to content the user did not mean to process with this skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code invokes an external executable (soffice/libreoffice) on a user-supplied document, which is a safety-relevant operation for a code file. Although the module docstring mentions normalization through LibreOffice, there is no runtime disclosure, confirmation, or explicit user-facing warning near the subprocess execution or CLI flow.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: scripts/extract_docx.py:32