Wechat Mp Editor

• Outcome: Review
• Latest audit: May 28, 2026 · 10:18 AM UTC
• Version: 1.0.2

Overview

The skill mostly matches its WeChat publishing purpose, but it handles account credentials and can change or publish official-account content without strong explicit confirmation boundaries.

Install only if you intend to let the agent use WeChat Official Account credentials. Keep credentials scoped and private, review any generated article and API payload before submission, and require explicit confirmation before uploads, draft updates, publication, or deletion. Treat bundled drafts and idea notes as content, not operational instructions to execute.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (9)

Tainted flow: 'req' from os.environ (line 125, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={'Content-Type': 'application/json'}
)
try:
    resp = urllib.request.urlopen(req)
    result = json.loads(resp.read())
    print(f"API Response: {json.dumps(result, ensure_ascii=False, indent=2)}")
    if 'media_id' in result:

• Confidence: 97% confidence
• Finding: resp = urllib.request.urlopen(req)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly expects credential access, local file reads/writes, and network calls to the WeChat API, but it declares no permissions. That creates a governance gap: users and policy systems are not informed that the skill can access local secrets and publish remote content, increasing the risk of silent credential use or unintended publication.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: The skill expands from article editing/publishing into external topic sourcing from ClawHub/GitHub Trending. This broadens network/data exposure and may cause the agent to fetch third-party content unrelated to the user's direct request, increasing the chance of prompt injection, untrusted content ingestion, or unnecessary external access.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill claims it will call dreamina-cli, which introduces an undeclared tool/command execution capability beyond the core WeChat API workflow. Hidden CLI invocation increases attack surface because command execution and local environment interaction can be abused or can process untrusted prompt content without clear permission boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The HTML article contains operational instructions to install and configure unrelated AI-agent skills and a cron job, which falls outside the declared purpose of a WeChat MP editor skill. In a publishing/editing context, embedding actionable system-configuration guidance can mislead downstream agents or users into performing unintended changes, creating a prompt-injection or scope-confusion risk.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger language is broad enough to activate on general writing, editing, formatting, or draft-management requests without clear boundaries. Over-broad activation can cause the skill to handle requests that unexpectedly involve credentials, local files, or remote publishing when the user only wanted drafting help.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The description does not clearly warn that the skill uses local credentials and can create, update, or publish content through the WeChat API. Without an upfront warning, users may not realize the skill can perform state-changing remote actions or access stored secrets on their behalf.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: wechat-mp-editor
description: "Create, edit, and manage WeChat Official Account (公众号/服务号) articles via the official WeChat API. Handles access token management, image uploads, draft CRUD, publishing, and HTML content formatting with WeChat-compatible CSS. Trigger when the user asks to: write/edit WeChat articles, create/publish drafts, format WeChat push notifications, generate article HTML, or manage WeChat MP drafts through the API."
---

# WeChat MP Editor

• Confidence: 93% confidence
• Finding: access token

Credential Access

High

• Category: Privilege Escalation

Content

## Overview

Full workflow: credentials → access token → image upload → draft creation → publishing.

**One fixed template** — visual branding consistent. Only content (text, date, banner) changes.

• Confidence: 94% confidence
• Finding: access token

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.