微信公众号发布

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a WeChat publishing helper, but it includes under-scoped draft deletion, account-token handling, dependency, and local-record update behaviors that users should review before installing.

Review this skill before installing if it will use a real WeChat account. It needs WeChat credentials and can create, publish, list, and delete drafts; avoid running the rebuild script unless you understand the hardcoded media IDs and paths. Store ~/.config/wx-mp securely, tighten token-file permissions, and prefer a consistent HTTPS lockfile before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/wx-publish.js:29

Finding

WeChat Access Token Stored Without Explicitly Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/package-lock.json:6

Finding

Dependency Lockfile Uses an Insecure Source and Conflicts With the Package Manifest

Content

View full analysis

= 20" } } ``` The package manifest specifies a different major-version range: ```json "dependencies": { "marked": "^12.0.0" } ``` The documentation additionally recommends an unpinned installation command: ```bash npm install marked ``` ### Technical Analysis The dependency metadata has two security and reproducibility weaknesses: 1. The lockfile retrieves the package through a plaintext HTTP URL. Transport encryption and server authentication are absent. 2. The manifest requests `marked` 12.x while the lockfile records a 17.x dependency range and package version. The SHA-512 integrity value should cause npm to reject a modified archive whose content does not match the lockfile. Consequently, a network attacker who changes only the archive would normally cause installation failure rather than successful malicious-code execution. However, use of an unauthenticated mirror still permits denial of service and weakens source provenance. If integrity metadata is regenerated or changed through an untrusted installation workflow, the unsafe source can become a dependency-execution path. The major-version inconsistency also makes the installed version dependent on whether the operator uses `npm install`, `npm ci`, or regenerates the lockfile. This undermin ...[truncated 1677 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose and the detected behavior do not align: the skill claims a narrow Markdown-to-WeChat publishing workflow, while the surfaced capabilities/functions suggest additional operations and omit some advertised processing steps. This mismatch is dangerous because users and orchestrators may grant trust or permissions based on the description, while the actual implementation can perform different state-changing actions such as deletion or broader publication helper behavior.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

`wx-publish.js` 内置自动去除：`content.replace(/^---\n[\s\S]*?\n---\n/, '')`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wx-api.js (reported line 86)May include surrounding context.

js

});
}

// ── Access Token ─────────────────────────────────────────

async function getToken() {
  const cache = loadTokenCache();

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/wx-publish.js (reported line 68)May include surrounding context.

js

});
}

// ── Access Token ─────────────────────────────────────────

async function getToken() {
  const cache = loadTokenCache();

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill documents command execution and environment-dependent behavior but does not declare an explicit tool scope such as allowed-tools or permissions. That makes the execution boundary ambiguous, increasing the chance an agent invokes shell or environment access beyond what a user would reasonably expect from a publishing skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description and invocation scope are entirely framed around publishing WeChat public-account articles in Chinese, and later sections prescribe fixed Chinese wording and formatting. This creates a locale/language constraint without explicitly offering the user a choice or documenting an opt-in, which matches the policy category for language/locale violations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill expands from article publishing into research, article drafting rules, and maintenance of local knowledge and analytics files. This broadens the operational scope from a bounded publishing task into data collection and persistent local modification, which can lead to unintended access or writes unrelated to the user’s immediate request.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation instructs the agent to use web_search for fact-checking even though the stated skill purpose is publishing to WeChat. Unnecessary networked research increases attack surface, may expose user topics or drafts to external services, and grants the skill a broader capability than users would infer from a publishing tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill directs maintenance of local fact files and article metadata beyond the narrow publication workflow. Persistent writes to local knowledge bases can alter user data, create integrity issues, and leak or entrench information unrelated to the current publication request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions describe updating article-tracker.json and other local records without a clear warning that the agent will modify user data. Silent or implicit persistent writes are risky because they can change records unexpectedly, introduce incorrect analytics, or normalize broader file modification behavior under a publishing skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The title and entire guidance are framed specifically for WeChat Official Account publishing in Chinese, and the document does not offer any language or locale choice. Because the policy category covers language/locale constraints, this reads as a forced locale/language assumption rather than an explicit opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a publishing skill that converts Markdown and publishes drafts to a WeChat public account, but it does not mention reading secrets from local configuration files or token caches in the user's home directory. While network publication is expected, credential harvesting from dot-config paths is a separate capability that should be explicitly declared if part of the skill's intended behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script deletes existing WeChat drafts via /draft/delete before recreating them, but the skill description only promises publishing, Markdown conversion, cover upload, and draft creation. This hidden destructive capability can remove user content unexpectedly if the mapping is wrong, stale, or manipulated, causing data loss and violating user expectations for a publishing tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes Markdown-to-WeChat publishing features such as conversion, cover upload, draft creation, publish submission, and error handling. This file also exposes management operations to enumerate existing drafts and delete drafts, which are not mentioned in the stated skill scope and go beyond the described publishing flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The del-draft command performs an irreversible destructive action immediately after receiving a media_id, with no confirmation prompt, dry-run mode, or safety interlock. In an agent/automation context, a mistaken argument, prompt-injected instruction, or operator misunderstanding could silently delete legitimate draft content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret range (^12.0.0), which permits automatic installation of newer 12.x releases rather than a single vetted version. In a publishing skill that converts untrusted Markdown to HTML, unexpected upstream changes or a compromised package release could alter parsing behavior or introduce a supply-chain issue, though this file alone does not show active exploitation.

Content

Scanner excerpt · scripts/package.json (reported line 6)May include surrounding context.

json

"version": "1.0.0",
  "description": "微信公众号发布脚本",
  "dependencies": {
    "marked": "^12.0.0"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file presents all user-facing content exclusively in Chinese, and there is no indication that the user opted into that language or that the skill is intended only for a Chinese-language audience. Under the language/locale policy rule, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script hard-codes toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' }) and all user-facing CLI messages are in Chinese, which forces a specific language/locale behavior without opt-in. This can violate language/locale policy where tools are expected to respect user preferences or provide a choice.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/wx-api.js:125

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/wx-publish.js:78