wacai-index-official-website-demand-dev

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:57 PM UTC
• Version: 1.0.0

Overview

The skill's website-change workflow is mostly coherent, but it can push repository changes and automatically send repository metadata or arbitrary summary-file contents to a hardcoded WeCom webhook.

Review carefully before installing. Only run it in repositories where automatic commit and push are acceptable, remove or replace the hardcoded WeCom webhook, avoid passing untrusted summary files or demand filenames, and add path validation and a confirmation step before push and notification.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/push_wecom_push_notice.py:13

Finding

Hardcoded WeCom webhook transmits repository metadata to a preconfigured external recipient

Content

View full analysis

str: commit_hash = run_git(project_dir, "rev-parse", "--short", commit_ref) commit_subject = run_git(project_dir, "show", "-s", "--format=%s", commit_ref) timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S") summary = summary.strip() if summary.strip() else summarize_from_diff(project_dir, commit_ref) return "\n".join([ f"时间：{timestamp}", f"项目：{project_dir}", f"分支：{branch}", f"提交：{commit_hash} {commit_subject}", "代码变动点：", summary, ]) ``` ```python parser.add_argument( "--webhook-url", default=os.environ.get("WECOM_WEBHOOK_URL", DEFAULT_WEBHOOK_URL), help="Override webhook URL" ) response_text = post_json(args.webhook_url, payload) ``` ```bash NOTICE_ARGS=(--project-dir "$PROJECT_DIR" --branch "$BRANCH" --commit-ref HEAD) if [[ -n "$SUMMARY_FILE" ]]; then NOTICE_ARGS+=(--summary-file "$SUMMARY_FILE") fi python3 "$SCRIPT_DIR/push_wecom_push_notice.py" "${NOTICE_ARGS[@]}" ``` ### Technical Analysis The notification script contains a complete WeCom webhook URL, including its secret webhook key. If `WECOM_WEBHOOK_URL` is not configured and the caller does not provide `--webhook-url`, the embedded endpoint is used automatically. After a successful Git push, `run_git_flow.sh` invokes the notification script without specifying a webhook URL. The script consequently sends the following information to the ...[truncated 1756 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/push_wecom_push_notice.py:47

Finding

Arbitrary local files can be read and transmitted through the summary-file option

Content

View full analysis

str: if args.summary: return args.summary.strip() if args.summary_file: return Path(args.summary_file).read_text(encoding="utf-8").strip() if args.stdin: return sys.stdin.read().strip() return "" ``` ```python parser.add_argument("--summary-file", help="Path to summary text file") parser.add_argument( "--webhook-url", default=os.environ.get("WECOM_WEBHOOK_URL", DEFAULT_WEBHOOK_URL), help="Override webhook URL" ) ``` ```python summary = read_summary(args) content = build_content(project_dir, args.branch, args.commit_ref, summary) payload = { "msgtype": "text", "text": { "content": content } } response_text = post_json(args.webhook_url, payload) ``` ### Technical Analysis The `--summary-file` argument accepts an unrestricted filesystem path. The script resolves no project boundary, performs no sensitive-path checks, does not reject symbolic links, and applies no file-size limit. It reads the complete UTF-8 contents and inserts them into the outbound webhook message. The shell wrapper forwards its third positional argument directly as `--summary-file`. Therefore, any caller able to influence this argument can make the script read any UTF-8 file accessible to the current operating-system user. The read operation uses the existing process privileges; it does not bypass operating-system permissions. Nevertheless, it exceeds the minimum access needed for a repository change summary because the file does not have to reside in the target project. ### Attack Path 1. An attacker or untrusted automation gains control over the `summary-file` argument. 2. The argument is set to a sensitive readable f ...[truncated 1169 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/run_git_flow.sh:20

Finding

Git option injection can stage and push files outside the requested file list

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/update_productdemand.sh:17

Finding

Demand filename traversal permits arbitrary writable-file overwrite outside the project

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description presents an end-to-end requirement-to-code modification workflow, including documentation sync, backup, code changes, validation, Git commit/push, and WeCom notification. The actual code chunk is much narrower: it is a Git automation helper that stages provided files, commits, pushes, and triggers a notice script. While branch update, commit/push, and notification broadly align with part of the description, several core declared behaviors are absent from this code: no requirement ingestion, no writing to productdemand.md, no backup, no code modification, and no validation. This is a material description-versus-behavior mismatch because the declared primary purpose is broader and more capable than what the supplied code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The actual code implements only a narrow subset of the declared behavior: creating the project directory, backing up an existing demand markdown file, and replacing it with the supplied input file. The declared description presents a much broader automation workflow involving repository operations, source code changes, validation, and external notification. Those core capabilities are absent from the supplied code chunk, so the description does not accurately represent what this code actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and recommends shell, git, file, environment, and network-driven actions but does not declare any explicit tool scope or allowed-tools boundary. In a skill that can modify arbitrary project paths, push code, and send webhooks, missing scope constraints increases the chance of overbroad execution and makes dangerous capabilities insufficiently governed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requires sending project path, branch, commit metadata, and code-change summaries to an external WeCom webhook without any warning, consent gate, minimization guidance, or destination validation. That can leak sensitive repository structure, internal filenames, branch names, and development activity to a third-party endpoint, especially dangerous because the skill operates on externally supplied project paths and potentially private codebases.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/push_wecom_push_notice.py (reported line 37)May include surrounding context.

python

def run_git(project_dir: Path, *args: str) -> str:
    result = subprocess.run(
        ["git", *args],
        cwd=str(project_dir),
        check=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script automatically sends project path, branch, commit hash/subject, changed-file-derived summary, and potentially diff-derived details to an external WeCom webhook. It also embeds a default webhook token directly in code, which can enable unintended outbound data disclosure and unauthorized notifications without explicit runtime consent or visibility to the operator.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code fetches, checks out, pulls, stages files, commits, and pushes to a remote branch, which changes repository state and transmits data to a remote system. While the script name suggests a git workflow, there is no confirmation prompt, cautionary comment, or user-facing warning in the file before these potentially impactful operations occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script invokes another program to send a notice using project directory, branch, commit reference, and optionally a summary file, which may transmit user or system data over a network. There is no warning, comment, or user-facing disclosure here explaining that metadata will be sent after the git operations complete.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script constructs commit messages with a fixed Chinese phrase, forcing a specific language regardless of user preference or repository conventions. This is a natural-language locale constraint with no opt-in, configurability, or justification present in the file.

Content

No source excerpt is available for this finding.