T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/wechat/api_client.py:84- Finding
Server-Side Request Forgery Through Unvalidated Image URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
Wechat Mp Publish
Security checks for vulnerabilities and agentic risk
Overview
This WeChat publishing skill is mostly purpose-aligned, but it has material safety issues around uploading local files, fetching arbitrary image URLs, and exposing WeChat tokens in logs.
Review carefully before installing. Use a dedicated low-privilege WeChat account, avoid passing secrets on the command line, do not upload untrusted Markdown or image paths, and patch token logging plus local-file and URL validation before using this with sensitive files or networks.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/wechat/api_client.py:91- Finding
Arbitrary Local File Read and External Upload
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wechat/api_client.py:70- Finding
WeChat Access Token Disclosed Through Debug Logging
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cli.py:163- Finding
App Secret Is Echoed During Input and Stored in Plaintext
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unbounded Dependency Versions Permit Non-Reproducible Package Resolution
- Content
View full analysis
=2.28.0 python-dotenv>=1.0.0 cryptography>=41.0.0 ``` The package metadata similarly uses a lower-bound-only dependency: ```toml dependencies = [ "requests>=2.28.0", ] ``` ### Technical Analysis The dependency declarations contain only minimum versions. There is no lockfile, upper bound, or hash verification. As a result, two installations performed at different times can resolve to different package versions and artifacts. No typosquatted package name, custom package index, or currently known malicious package was identified in the reviewed declarations. The risk is that future installation behavior is mutable after Skill review. A compromised upstream release, dependency-chain compromise, or incompatible future version could be selected automatically. Python package installation can execute build backend and installation-related code, making dependency integrity relevant even before the Skill itself runs. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` instruction. 2. Pip resolves the newest versions satisfying each `>=` constraint. 3. A future compromised, malicious, or unexpectedly incompatible artifact satisfies the constraint. 4. Pip downloads and installs that artifact without comparing it to a reviewed lockfile or expected hash. 5. Package installation code executes with the privileges of the installing user. 6. The affected dependency can subsequently influence the Skill's runtime network, cryptographic, or configuration behavior. ### Impact Assessment The maximum impact depends on the privileges used for installation. If dependencies are installed as a normal user, malicious package code can generally access that user's files and credentials. If installation is performed with elevated privileges, system- ...[truncated 216 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (85)
Tainted flow: 'params' from os.environ.get (line 129, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python } try: response = requests.get(url, params=params, timeout=10) data = response.json() if data.get("errcode") == 0:
Tainted flow: 'params' from os.environ.get (line 167, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python params = {"access_token": access_token} files = {"media": (filename, io.BytesIO(image_data), "image/jpeg")} response = requests.post(url, params=params, files=files, timeout=30) return response.json() def upload_permanent_image_from_url(self, image_url: str, access_token: str = None) -> dict:
Tainted flow: 'params' from os.environ.get (line 129, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python params = {"access_token": access_token, "type": "image"} files = {"media": ("cover.jpg", io.BytesIO(response.content), "image/jpeg")} upload_resp = requests.post(url, params=params, files=files, timeout=30) result = upload_resp.json() print(f"upload_permanent_image_from_url: result = {result}") return result
Tainted flow: 'params' from os.environ.get (line 129, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python # 手动序列化 JSON，确保中文不转义（关键修复） draft_json = json.dumps({"articles": articles}, ensure_ascii=False) headers = {"Content-Type": "application/json; charset=utf-8"} response = requests.post( url, params=params, data=draft_json.encode("utf-8"),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- 配置环境变量
bash cp .env.example .env # 编辑 .env 文件，填入你的微信公众号 AppID 和 AppSecret
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- 配置环境变量
bash cp .env.example .env # 编辑 .env 文件，填入你的微信公众号 AppID 和 AppSecret
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- 配置环境变量
bash cp .env.example .env # 编辑 .env 文件，填入你的微信公众号 AppID 和 AppSecret🚀 快速开始
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- 配置环境变量
bash cp .env.example .env # 编辑 .env 文件，填入你的微信公众号 AppID 和 AppSecret🚀 快速开始
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- 配置环境变量
bash cp .env.example .env # 编辑 .env 文件，填入你的微信公众号 AppID 和 AppSecret🚀 快速开始
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- 配置环境变量
bash cp .env.example .env # 编辑 .env 文件，填入你的微信公众号 AppID 和 AppSecret🚀 快速开始
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- 配置环境变量
bash cp .env.example .env # 编辑 .env 文件，填入你的微信公众号 AppID 和 AppSecret🚀 快速开始
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill text explicitly states that local images will be automatically uploaded and implies network interaction, but it does not fully disclose constraints around remote fetching, default external resources, or that the workflow only saves drafts rather than publishing. In a content-publishing skill, undeclared outbound transfers and mismatched user expectations can lead to unintended data disclosure and unsafe automation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill text explicitly states that local images will be automatically uploaded and implies network interaction, but it does not fully disclose constraints around remote fetching, default external resources, or that the workflow only saves drafts rather than publishing. In a content-publishing skill, undeclared outbound transfers and mismatched user expectations can lead to unintended data disclosure and unsafe automation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill text explicitly states that local images will be automatically uploaded and implies network interaction, but it does not fully disclose constraints around remote fetching, default external resources, or that the workflow only saves drafts rather than publishing. In a content-publishing skill, undeclared outbound transfers and mismatched user expectations can lead to unintended data disclosure and unsafe automation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill text explicitly states that local images will be automatically uploaded and implies network interaction, but it does not fully disclose constraints around remote fetching, default external resources, or that the workflow only saves drafts rather than publishing. In a content-publishing skill, undeclared outbound transfers and mismatched user expectations can lead to unintended data disclosure and unsafe automation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill text explicitly states that local images will be automatically uploaded and implies network interaction, but it does not fully disclose constraints around remote fetching, default external resources, or that the workflow only saves drafts rather than publishing. In a content-publishing skill, undeclared outbound transfers and mismatched user expectations can lead to unintended data disclosure and unsafe automation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill text explicitly states that local images will be automatically uploaded and implies network interaction, but it does not fully disclose constraints around remote fetching, default external resources, or that the workflow only saves drafts rather than publishing. In a content-publishing skill, undeclared outbound transfers and mismatched user expectations can lead to unintended data disclosure and unsafe automation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill text explicitly states that local images will be automatically uploaded and implies network interaction, but it does not fully disclose constraints around remote fetching, default external resources, or that the workflow only saves drafts rather than publishing. In a content-publishing skill, undeclared outbound transfers and mismatched user expectations can lead to unintended data disclosure and unsafe automation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill text explicitly states that local images will be automatically uploaded and implies network interaction, but it does not fully disclose constraints around remote fetching, default external resources, or that the workflow only saves drafts rather than publishing. In a content-publishing skill, undeclared outbound transfers and mismatched user expectations can lead to unintended data disclosure and unsafe automation.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The CLI advertises support for crawling arbitrary URLs and AI-based rewriting of third-party content, but that capability is not disclosed in the skill metadata. Hidden network-fetch and content-transformation behavior increases the risk of users unknowingly sending URLs/content to external systems and can facilitate plagiarism, unreviewed data exfiltration, or unsafe downstream processing.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file implements a local security-audit utility that enumerates sensitive files, reads configuration files, and inspects dependency metadata, which is unrelated to the stated skill purpose of publishing WeChat public-account articles. In a skill package, unrelated host-inspection logic increases the attack surface and creates an unnecessary capability to access local secrets and repository state.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
Scanning for .env files causes the skill to probe for common secret containers on the host. Because this is outside the expected scope of a publishing tool, it creates unnecessary access to locations likely to contain API keys and passwords.
- Content
python print("📁 检查敏感文件...") sensitive_files = [ '.env', 'config.local.json', 'credentials.json', '*.pem',
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Referencing credentials.json as a target for filesystem inspection is part of a broader pattern of enumerating sensitive credential material on the local machine. In a skill whose purpose is content publishing, this unnecessary awareness of credential files increases the risk of secret discovery and misuse if the code is extended or abused.
- Content
python sensitive_files = [ '.env', 'config.local.json', 'credentials.json', '*.pem', '*.key', ]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
Including .env and config.json in permission checks requires the skill to inspect metadata of files that may contain secrets. In this skill context, that is unnecessary host introspection and broadens access to sensitive material beyond what is needed to publish an article.
- Content
python """检查文件权限""" print("🔐 检查文件权限...") config_files = ['config.json', '.env'] for filename in config_files: file_path = self.project_root / filename
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
Requiring .gitignore to contain .env indicates the script is specifically concerned with locating and managing secret-bearing files in the repository. While not direct exfiltration, this is still unnecessary credential-oriented inspection for a publishing tool and contributes to excessive access to local project security posture.
- Content
python with open(gitignore_path, 'r', encoding='utf-8') as f: content = f.read() required_patterns = ['.env', 'config.local.json', '*.log', '__pycache__'] for pattern in required_patterns: if pattern not in content: