WeChat Draft Publisher Cloud

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:27 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but its publishing path can upload unintended local files and can send credentials and unpublished content over insecure relay URLs.

Install only if you control and trust the relay, configure it with HTTPS, use a strong relay key, and review Markdown from untrusted sources before running --real. Be especially careful with image paths, because a crafted article can cause local readable files outside the article folder to be uploaded.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/publish_script.py:94

Finding

Arbitrary local files can be uploaded through Markdown image references

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/md2wechat.py:42

Finding

Markdown conversion permits unsafe HTML and attribute injection

Content

View full analysis

str: final = img_map.get(src) or img_map.get(os.path.basename(src)) or src return (f'') def _inline(text: str, img_map: dict) -> str: """处理行内元素：图片、加粗、斜体、链接、行内代码。""" # 先抽出 inline code，避免其中的 * _ 被误当成强调 codes = [] def stash(m): codes.append(m.group(1)) return f"\x00{len(codes) - 1}\x00" text = re.sub(r'`([^`]+)`', stash, text) text = _IMG_RE.sub(lambda m: _img_tag(m.group(1), m.group(2), img_map), text) text = re.sub(r'\*\*(.+?)\*\*', r'\1', text) text = re.sub(r'\*([^*]+?)\*', r'\1', text) text = re.sub(r'\[([^\]]+)\]\(([^)\s]+)\)', r'\1', text) def restore(m): return ('' f'{_esc(codes[int(m.group(1))])}') return re.sub(r'\x00(\d+)\x00', restore, text) ``` ### Technical Analysis Ordinary Markdown text is not HTML-escaped before it is inserted into generated HTML. Only fenced and inline code content is passed through `_esc()`. Consequently, raw HTML included in headings, paragraphs, lists, or block quotes can survive conversion. Image alternative text and resolved image URLs are interpolated directly into quoted attributes. Markdown link destinations are likewise inserted directly into `href` without attribute escaping or scheme validation. This permits malformed attribute injection and unsafe schem ...[truncated 1511 chars]

Remediation

View remediation

`, `"`, and `'`. 3. Parse Markdown into structured tokens rather than applying HTML-generating regular expressions directly to untrusted text. 4. Allowlist link schemes, preferably permitting only `https` and optionally `http`. 5. Reject `javascript:`, `data:`, `vbscript:`, control characters, and scheme-obfuscation attempts in link destinations. 6. Require image URLs returned by the relay to use expected HTTPS hosts or another documented allowlist. 7. Apply a strict HTML sanitizer to the completed output before publishing, with an allowlist of necessary tags, attributes, and CSS properties. 8. Add tests covering raw HTML, quote injection, unsafe URL schemes, encoded schemes, malformed Markdown, and control characters. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/publish_script.py:48

Finding

Relay URL validation permits plaintext transmission of credentials and unpublished content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents the skill as an end-to-end WeChat draft publisher that sends markdown content and cover images to a public account draft box through a relay service. The supplied code chunk does something narrower and materially different: it only transforms markdown into WeChat-friendly HTML and extracts image references. The module docstring explicitly says image upload is handled elsewhere and that this module is only responsible for text-to-HTML conversion. There is no network access, no relay usage, no authentication/config handling, and no publishing logic. This is not just an internal helper detail if the declared purpose is the overall skill behavior; the actual code chunk lacks the core advertised capability.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

python scripts/publish_script.py --article X.md --cover Y.png --titles-md T.md

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

python scripts/publish_script.py --article X.md --cover Y.png --titles-md T.md

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

python scripts/publish_script.py --article X.md --cover Y.png --titles-md T.md

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

python scripts/publish_script.py --article X.md --cover Y.png --titles-md T.md

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly instructs users to send article content, images, and an access key to a publicly reachable relay service, but it does not clearly warn about the confidentiality and trust implications of doing so. Because the relay is internet-accessible and receives both content and authentication material, users may unknowingly expose unpublished article data or misuse a weakly protected endpoint if the relay is compromised, misconfigured, or operated by an untrusted party.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill describes capabilities that involve reading environment variables, reading and writing local files, and making authenticated network requests, but it does not declare any tool scope or permission boundaries. In an agent ecosystem, this creates an authorization gap where the runtime or reviewer cannot clearly constrain what the skill is allowed to access, increasing the risk of unintended data exposure or unreviewed side effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes this skill as a 公众号草稿发布器 that pushes Markdown and cover images into the WeChat draft box. This file also exposes deletion operations for existing drafts via --delete/--delete-batch and the /draft-delete relay endpoint, which is a distinct destructive capability not mentioned in the manifest description or trigger phrases.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest explicitly says the skill is for publishing WeChat drafts and says it is not triggered for unrelated domains like email. The optional Feishu notification path adds outbound messaging behavior to a separate platform, which is not necessary to publish drafts and is not declared in the manifest scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example values use Chinese-only placeholder text such as "你的服务名", "地域", and "你的 RELAY_API_KEY". This imposes a specific language on users without any opt-in or alternative, which matches the policy category for language/locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring is entirely in Chinese and explicitly targets WeChat content conversion, which imposes a specific language/locale context in the skill's user-facing natural-language description. There is no indication that users can choose another language or that the locale restriction is optional.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill’s stated purpose is converting Markdown and publishing a WeChat draft through a relay. The append_covered functionality records owner/repo tracking entries in a local markdown file, which appears to support some external workflow and is not an obvious requirement of draft publishing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.