T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/wechat_fetch.py:40- Finding
Unrestricted Browser Navigation Enables SSRF and Local Resource Access
- Content
View full analysis
- Remediation
View remediation
Security audit
微信公众号文章抓取
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent WeChat article-reporting purpose, but its browser and file-writing scripts are under-scoped enough to risk unintended local/private URL access and file overwrite if inputs are untrusted.
Install only if you are comfortable running a browser automation scraper that sends search terms to Sogou/WeChat, stores fetched article content locally, and asks the current model to summarize it. Treat articles_new.json and keyword inputs as trusted-only until the skill validates URL hosts, escapes report HTML, and sanitizes output filenames to prevent path traversal and unintended file overwrite.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wechat_pdf.py:91- Finding
Persistent HTML Injection in Locally Rendered PDF Report
- Content
View full analysis
:"/\\|?*]', '', title)[:50] pdf_filename = f"{i:02d}_{filename}.pdf" local_pdf_path = f"{pdf_dir}/{pdf_filename}" # 转换日期格式 date = convert_relative_time(art.get('date', '')) articles_html += f"""""" ``` ```python # scripts/wechat_pdf.py:112-117 html_content = f""" {keyword}行业动态研究报告 ``` ```python # scripts/wechat_pdf.py:220-222 # Playwright needs absolute path abs_html = os.path.abspath(html_file) await page.goto(f'file://{abs_html}') ``` ### Technical Analysis Article titles, sources, dates, summaries, and the command-line keyword are inserted directly into an HTML document without contextual escaping. The article URL is passed through `html.escape()` with `quote=False`, which deliberately leaves quotation marks unescaped even though the value is inserted into a quoted HTML attribute. An attacker-controlled value can therefore terminate an element or attribute and inject arbitrary HTML. Depending on Chromium behavior and browser configuration, injected script or active content can execute when Playwright opens the generated report through a `file://` URL. Injected elements can also initiate network requests, ...[truncated 1519 chars]{i}. {art['title']}
{art['source']} | {date}
{art.get('summary', '摘要生成中...')}
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wechat_pdf.py:235- Finding
User-Controlled Keyword Enables Path Traversal and File Overwrite
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:102- Finding
Unpinned Runtime Dependencies and Browser Artifacts
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims to collect article metadata but also describes fetching full article bodies, opening each article detail page, capturing final URLs, and writing full text to local JSON. That is a substantial expansion of network and data-handling scope, increasing privacy, copyright/compliance, and data-exfiltration risk compared with the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill claims to collect article metadata but also describes fetching full article bodies, opening each article detail page, capturing final URLs, and writing full text to local JSON. That is a substantial expansion of network and data-handling scope, increasing privacy, copyright/compliance, and data-exfiltration risk compared with the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill claims to collect article metadata but also describes fetching full article bodies, opening each article detail page, capturing final URLs, and writing full text to local JSON. That is a substantial expansion of network and data-handling scope, increasing privacy, copyright/compliance, and data-exfiltration risk compared with the declared purpose.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs reading and writing multiple local files (
articles.json,articles_new.json,wechat_pages/*.pdf, final report PDF) but declares no tool scope or permissions. This creates an authorization and transparency gap: an agent could modify the user's workspace and generate files without an explicit capability declaration, making unintended file-system effects harder to review or constrain.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow explicitly sends fetched article content to the current chat model for summarization, yet the skill does not prominently warn about external content retrieval and model processing. This creates a privacy and data-governance risk because full article text and potentially sensitive material may be transmitted, retained, or processed outside the user's expectations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script’s implemented behavior materially differs from the advertised skill behavior: instead of performing a keyword-based WeChat search and extracting metadata, it reads a local JSON file of URLs and renders entire pages to PDF. In an agent setting, this can hide undeclared collection of arbitrary URLs and content, expanding access beyond user intent and making the skill capable of processing attacker-supplied local inputs without transparent disclosure.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The docstring and CLI usage imply the keyword argument controls what is fetched, but the code ignores it and processes every entry in a local file. This discrepancy is dangerous because users or higher-level agents may believe execution is scoped to a requested query when in fact arbitrary pre-populated URLs are fetched, enabling unintended data access or exfiltration through misleading interface semantics.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file contains natural-language instructions and status/error messages exclusively in Chinese, which effectively forces a specific language on users. The policy allows fixed locale behavior only when user opt-in is offered or the locale restriction is clearly justified, neither of which is present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code sends user-provided search keywords to Sogou/WeChat-related third-party services and then follows result links, but it does not warn users that their queries and browsing activity will leave the local environment. In this skill context, keywords may reveal research interests or sensitive topics, so undisclosed network exfiltration of user input is a meaningful privacy and operational risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata says it should collect titles, summaries, publication dates, and source accounts, but the code opens each article page, extracts the full body text, and stores it locally. This creates a data over-collection issue: it gathers substantially more third-party content than disclosed, increasing privacy, copyright, and compliance risk if the skill is used or redistributed at scale.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
技能描述声称最终产物是 PDF 报告，但该脚本仅将结果序列化到 articles.json，没有任何 PDF 生成逻辑。这里不是实现细节差异，而是输出形式与技能宣称的核心结果不一致。
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill creates several local artifacts, including JSON intermediates, a directory of per-article PDFs, and a final report, but does not clearly warn users up front. Lack of notice can lead to unexpected disk usage, residual sensitive content on disk, and confusion about what was created or where it was stored.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Error output is presented only in Chinese, and there is no indication elsewhere in the file that users can choose another language. This is a natural-language policy concern because the skill imposes a locale without explicit opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module docstring and all user-facing messages indicate the skill is designed to operate only in Chinese, and there is no option for the user to choose another language or locale. This matches the policy category for forced language/locale behavior without explicit opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Natural-language text throughout the script, including the module docstring and runtime messages, is exclusively in Chinese. There is no opt-in, language selection, or stated justification that this skill is intended only for a Chinese-speaking or region-specific context.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script persistently writes scraped article data to a fixed file in the workspace without clearly disclosing that collected content will be stored locally. Undisclosed persistence can expose sensitive search activity or retained third-party content to other local processes, users, or later workflow steps that access the workspace.
- Content
Static analysis
No suspicious patterns detected.