Security audit

wechat-article-reader

Security checks across malware telemetry and agentic risk

Overview

This skill appears to fetch and summarize user-provided WeChat article links, with disclosed network behavior that fits its purpose, but users should understand it contacts external sites and relies on unpinned dependencies.

Install only if you are comfortable with the skill making outbound requests to fetch article URLs you provide. Avoid submitting private or access-controlled links, and prefer a version that narrows triggers, documents network/privacy behavior clearly, and pins dependencies to reviewed versions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation indicates outbound network access via requests to fetch WeChat article content, but no corresponding permissions are declared. This creates a security and governance gap: users or the platform may not be aware the skill performs external requests, which can lead to unexpected data exposure, SSRF-like abuse if URL validation is weak, or policy bypass around network-capable skills.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The README explicitly describes making outbound requests to user-supplied WeChat article URLs and using anti-crawling techniques such as User-Agent rotation, but it does not warn users that submitted links and related request metadata will be transmitted to third-party servers. This creates a real privacy and transparency issue: users may unknowingly cause external network access, disclose browsing targets, or trigger requests to content they did not intend to fetch through the skill.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The keyword trigger list is broad and generic enough to activate on common Chinese words like '读取', '总结', and '摘要', which can cause the skill to run outside the user's intended context. In a processor skill with network access and automatic URL triggers, unintended activation can lead to unnecessary external requests, privacy issues, and confusing cross-platform behavior.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The skill metadata and trigger phrasing assume Chinese-language interaction and公众号-specific behavior without an explicit opt-in or locale check. This can cause unintended activation or mismatched behavior for users on supported platforms who did not request Chinese-language processing, reducing predictability and potentially causing accidental handling of content they did not mean to submit.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 fake-useragent>=1.4.0
Confidence: 95% confidence
Finding: The dependency is specified with a minimum version only, which allows installation of any newer release and makes builds non-reproducible. That increases supply-chain risk because different environments may resolve to different versions, including unexpectedly broken or maliciously compromised releases.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 fake-useragent>=1.4.0
Confidence: 95% confidence
Finding: The package is not pinned to an exact version, so installations may pull different releases over time. This weakens reproducibility and increases exposure to upstream supply-chain issues or incompatible updates.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 fake-useragent>=1.4.0
Confidence: 96% confidence
Finding: Using a lower-bound-only version specifier for lxml permits unreviewed future versions to be installed, making dependency resolution unpredictable. For a parser library handling remote content, that can increase exposure to newly introduced defects or compromised releases.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 fake-useragent>=1.4.0
Confidence: 94% confidence
Finding: The fake-useragent dependency is also unpinned, allowing arbitrary newer releases at install time. This creates avoidable supply-chain and reproducibility risk, especially for third-party libraries that may change behavior significantly between releases.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 89% confidence
Finding: The skill depends on requests with a broad version range and the scanner reports multiple known advisories affecting the package family. In a skill that fetches attacker-controlled URLs such as WeChat article links, HTTP client flaws can enable credential leakage, request tampering, or unsafe transport behavior depending on the resolved version.

Known Vulnerable Dependency: lxml — 10 advisory(ies): CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +7 more

High

Category: Supply Chain
Confidence: 87% confidence
Finding: The skill uses lxml, and the scanner reports multiple known advisories affecting versions of that library. Because this skill parses untrusted remote article content, parser or HTML-cleaning vulnerabilities are more relevant and could lead to unsafe processing of crafted markup or downstream injection risks if sanitized output is reused.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.