Wechat Article For Ai

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:52 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it gives an agent broad network and file-writing behavior with weak limits, including unvalidated article-controlled image downloads that can reach internal services.

Install only in a sandbox or low-privilege environment. Use a dedicated output directory, avoid processing untrusted article URLs with image downloads enabled, consider --no-images for unknown content, and pin or review dependencies and the Camoufox browser artifact before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: wechat_to_md/downloader.py:42

Finding

Article-Controlled Image URLs Enable Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: wechat_to_md/downloader.py:45

Finding

Unbounded Image Downloads and Caller-Controlled Concurrency Permit Resource Exhaustion

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Dependencies and Automatic Browser Retrieval Create Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes 'anti-detection scraping' to bypass WeChat bot detection, which indicates intentional circumvention of a target platform's access controls rather than ordinary content conversion. In an AI-integrated skill context, this is riskier because it can encourage automated collection against service restrictions and normalizes stealth behavior that may be reused for broader unauthorized scraping.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and requires filesystem and network behavior, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, that omission can cause overbroad invocation, weak user consent, and unclear trust boundaries around reading inputs, downloading remote content, and writing files locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file documents that the tool writes converted articles and images to an output directory and can overwrite existing output with --force, but it does not explicitly warn users that local files and directories will be created or replaced. Under the markdown-specific warning rule, data-affecting behavior should be clearly disclosed to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description explains functionality but does not clearly warn that it will download article bodies and images and persist them to the local filesystem. This can lead users or higher-level agents to trigger the skill without understanding that it creates local copies of third-party content, which has privacy, storage, and compliance implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The MCP/tooling section describes remote fetching behavior but does not provide an explicit privacy or network warning that supplied URLs and related requests are sent to external services. In agent workflows, this can expose browsing targets, metadata, and fetched content to remote endpoints without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency 'markdownify' is unpinned, which makes builds non-reproducible and can cause the skill to install a vulnerable or breaking release in the future without review. In a content-conversion skill that processes untrusted remote article content, unexpected upstream changes increase supply-chain and stability risk.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

camoufox[geoip]
markdownify
beautifulsoup4
httpx
mcp

Unverifiable Dependency: markdownify has 2 known advisory(ies) (CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo); CVE-2025-46656 (markdownify allows large headline prefixes such as <h9999999>, which causes memo)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

A known advisory exists for 'markdownify', but the requirements file does not pin a version, so the deployment may resolve to an affected release. Since this skill converts remote article HTML into Markdown, malformed input could trigger vulnerable parsing behavior if an affected version is installed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency 'beautifulsoup4' is unpinned, so installs may resolve to different versions over time. This weakens reproducibility and can silently introduce vulnerable or incompatible releases into a parser that handles attacker-controlled HTML.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

camoufox[geoip]
markdownify
beautifulsoup4
httpx
mcp

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency 'httpx' is unpinned, allowing future installs to pull arbitrary newer releases within resolver behavior. Because this skill likely fetches remote WeChat content and images over the network, an unreviewed HTTP client version can affect request handling and security posture.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

camoufox[geoip]
markdownify
beautifulsoup4
httpx
mcp

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The file does not pin 'httpx', and there are known advisories for some versions, so it is impossible to verify whether installations are safe. Because the skill likely performs remote HTTP fetching, an affected HTTP client version could expose input-validation or request-handling weaknesses in normal operation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency 'mcp' is unpinned, creating supply-chain uncertainty and making it impossible to know which code will actually run at install time. This is more concerning than a pure utility library because MCP-related packages can expose protocol/server functionality with meaningful security consequences if vulnerable features are present.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

markdownify
beautifulsoup4
httpx
mcp

Unverifiable Dependency: mcp has 12 known advisory(ies) (CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2026-52870 (MCP Python SDK: Experimental task handlers allow any client to access and cancel) +9 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The 'mcp' package has multiple known advisories, but no version is pinned, so the installed release may include vulnerable functionality. This is more dangerous in context because MCP libraries can affect server/protocol behavior, and if the skill exposes or later enables MCP features, issues such as rebinding or task access flaws could become exploitable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This code fetches remote WeChat article content, optionally downloads images, creates directories, and writes Markdown files to disk. While the docstring describes parameters and outputs, it does not clearly warn users that invoking the tool will make network requests and persist downloaded content locally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file hardcodes SHANGHAI_TZ = timezone(timedelta(hours=8)) and format_timestamp always renders timestamps in Asia/Shanghai. This is a natural-language locale policy concern because the behavior imposes a specific locale/timezone without any user opt-in or visible justification in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.