Security audit

微信公众号发布

Security checks for vulnerabilities and agentic risk

Overview

This is a real WeChat publishing skill, but it includes broad local record-writing and account-level draft deletion that users should review carefully before installing.

Install only if you intend to let this skill operate a WeChat public-account workflow with credential access. Review or remove the delete and rebuild scripts, confirm every publish/delete action manually, and consider disabling automatic web research and local facts/tracker updates unless you explicitly want that behavior.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a WeChat article publishing tool, but these instructions expand its scope into autonomous web research and persistent modification of a local facts repository. That scope creep is dangerous because it authorizes network access and writes to unrelated local files, increasing data integrity risk and creating opportunities for unintended prompt-driven actions outside the user's publishing intent.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This section extends a publishing skill into operational analytics maintenance by editing `article-tracker.json`, which is unrelated to the declared publication purpose. That makes the skill more dangerous in context because a user invoking 'publish this article' could unknowingly trigger writes to historical tracking data, creating unauthorized state changes and possible corruption of business records.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The instructions explicitly require `web_search` for fact checking even though the skill's stated purpose is publication, not online research. In a security context, unnecessary network access broadens the attack surface, can leak sensitive draft context to external services, and makes the skill capable of acting beyond the user's expected trust boundary.

Context-Inappropriate Capability

Low

Confidence: 85% confidence
Finding: The document includes a concrete微信公众号封面图 media_id, which is an operational identifier rather than general best-practice guidance. Exposing live resource identifiers can facilitate unauthorized reuse of account assets, leak internal configuration details, and aid attackers in mapping the publishing workflow for the associated WeChat account.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The script exposes a destructive draft-deletion command without any confirmation, dry-run mode, access-control boundary, or user-facing safety guard. In an agent skill context, hidden or weakly documented destructive capabilities are riskier because an invoking workflow could delete content unexpectedly or under prompt manipulation, causing integrity loss for the user's公众号 drafts.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The script deletes existing remote drafts automatically using stored oldMediaId values before creating replacements, with no confirmation prompt, dry-run mode, or rollback protection. In the context of a publishing skill, this can cause irreversible content loss or unintended destruction of production drafts if run on the wrong account or with stale mappings.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script caches the credential-derived access token on disk in the user's home directory without setting restrictive file permissions or warning the user. If the local environment is shared, backed up broadly, or otherwise accessible to other processes/users, the token could be stolen and used to act on the公众号 account until expiration, enabling unauthorized API operations.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/wx-api.js:125

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/wx-publish.js:78