ClawHub
Back to skill

Security audit

ReadGZH -- 微信公众号文章 AI 阅读器

Security checks across malware telemetry and agentic risk

Overview

ReadGZH is a disclosed cloud connector for reading WeChat articles, with real privacy cautions because submitted links and converted content may be cached globally.

Install only if you are comfortable sending WeChat article links, request metadata, and any ReadGZH API key to ReadGZH's cloud service. Do not use it for private, tokenized, internal, regulated, or sensitive links because converted content may be permanently cached and visible to other users.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (18)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The README suggests a natural-language trigger phrase ('帮我读一下这篇文章...') that is very broad and overlaps with normal user conversation. In agent environments, overly generic invocation phrasing can cause accidental tool activation on ordinary chat content, leading to unintended fetching of external URLs and content processing without clear user intent.

Missing User Warnings

High
Confidence
97% confidence
Finding
The README explicitly states that article content is fetched through a server-side proxy and that converted articles are permanently cached and globally shared, but it does not prominently warn users about the privacy and data-retention implications. This can expose article URLs, contents, and access patterns to a third-party service and retain potentially sensitive material indefinitely.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The Chinese invocation example uses a very generic phrase ('help me read this WeChat article') that overlaps with normal assistant requests. In agent ecosystems where skills are auto-selected from natural language, this can cause the skill to activate unexpectedly and send user-supplied URLs to the external service without sufficiently explicit user intent for this specific integration.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The English invocation example is similarly broad and looks like an ordinary assistant prompt rather than a constrained skill trigger. This increases the chance of unintended skill invocation and external transmission of article URLs or related context to the service when the user may not realize a third-party tool is being used.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 方式一：GET 直接抓取（推荐 AI 使用）
curl "https://api.readgzh.site/rd?url=https://mp.weixin.qq.com/s/xxxxx" \
  -H "Authorization: Bearer <YOUR_API_KEY>"

# 方式二：POST 抓取并缓存
Confidence
90% confidence
Finding
This skill instructs agents to send user-provided article URLs to an external domain and include an Authorization bearer token. Any such integration creates a data exfiltration boundary: user queries, URLs, and potentially access tokens are transmitted to a third-party service outside the local trust boundary.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Method 1: GET direct fetch (recommended for AI)
curl "https://api.readgzh.site/rd?url=https://mp.weixin.qq.com/s/xxxxx" \
  -H "Authorization: Bearer <YOUR_API_KEY>"

# Method 2: POST scrape and cache
Confidence
90% confidence
Finding
The English REST example also directs traffic and bearer-token use against an external API. This is risky in agent settings because a model may autonomously invoke the endpoint with sensitive URLs or mishandle credentials during logging, replay, or prompt injection scenarios.

External Transmission

Medium
Category
Data Exfiltration
Content
{
  "mcpServers": {
    "readgzh": {
      "url": "https://api.readgzh.site/mcp-server"
    }
  }
}
Confidence
88% confidence
Finding
The MCP server configuration causes the agent platform to connect to a third-party server, extending trust to external infrastructure. MCP connections can expose prompts, tool arguments, metadata, and possibly credentials depending on platform behavior, so this is a real external transmission risk.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 方式一：GET 直接抓取（推荐 AI 使用）
curl "https://api.readgzh.site/rd?url=https://mp.weixin.qq.com/s/xxxxx" \
  -H "Authorization: Bearer <YOUR_API_KEY>"

# 方式二：POST 抓取并缓存
Confidence
90% confidence
Finding
This skill instructs agents to send user-provided article URLs to an external domain and include an Authorization bearer token. Any such integration creates a data exfiltration boundary: user queries, URLs, and potentially access tokens are transmitted to a third-party service outside the local trust boundary.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer <YOUR_API_KEY>"

# 方式二：POST 抓取并缓存
curl -X POST "https://api.readgzh.site/rd" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://mp.weixin.qq.com/s/xxxxx"}'
Confidence
91% confidence
Finding
The POST example sends a user-supplied URL to a third-party API for scraping and caching. Because the document states content is globally cached, submitted links may become available to others, increasing privacy and confidentiality risk beyond a simple one-time API call.

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"url": "https://mp.weixin.qq.com/s/xxxxx"}'

# 读取已缓存文章（Markdown 格式）
curl "https://api.readgzh.site/rd?s=article-slug&format=text" \
  -H "Authorization: Bearer <YOUR_API_KEY>"

# 长文分页读取（第 2 部分）
Confidence
85% confidence
Finding
Reading cached content from the external API still transmits identifiers and request metadata to a third-party service. While lower risk than initial upload, it continues the external data-sharing model and may reveal user interests, article access patterns, or internal workflow context.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer <YOUR_API_KEY>"

# 长文分页读取（第 2 部分）
curl "https://api.readgzh.site/rd?s=article-slug&part=2" \
  -H "Authorization: Bearer <YOUR_API_KEY>"

# AI 智能摘要（Pro 专属）
Confidence
84% confidence
Finding
Paginated retrieval of cached articles is another form of outbound communication to the same service. Repeated chunk requests can leak sustained interest in specific content and may transfer larger amounts of externally sourced text into the agent context, increasing downstream prompt-injection exposure from untrusted article content.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer <YOUR_API_KEY>"

# AI 智能摘要（Pro 专属）
curl "https://api.readgzh.site/rd?s=article-slug&mode=summary" \
  -H "Authorization: Bearer <YOUR_API_KEY>"
```
Confidence
87% confidence
Finding
The summary mode sends article references to an external service that performs AI-generated processing, potentially expanding exposure of content and metadata. This creates both privacy risk and integrity risk, as summarized content may be influenced by untrusted remote processing outside the local security boundary.

External Transmission

Medium
Category
Data Exfiltration
Content
{
  "mcpServers": {
    "readgzh": {
      "url": "https://api.readgzh.site/mcp-server"
    }
  }
}
Confidence
88% confidence
Finding
The MCP configuration in the English section reiterates a trust relationship with an external MCP server. In agent environments, such servers can receive tool inputs and contextual information, so connecting to them without strong governance is a genuine security concern.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Method 1: GET direct fetch (recommended for AI)
curl "https://api.readgzh.site/rd?url=https://mp.weixin.qq.com/s/xxxxx" \
  -H "Authorization: Bearer <YOUR_API_KEY>"

# Method 2: POST scrape and cache
Confidence
90% confidence
Finding
The English REST example also directs traffic and bearer-token use against an external API. This is risky in agent settings because a model may autonomously invoke the endpoint with sensitive URLs or mishandle credentials during logging, replay, or prompt injection scenarios.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer <YOUR_API_KEY>"

# Method 2: POST scrape and cache
curl -X POST "https://api.readgzh.site/rd" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://mp.weixin.qq.com/s/xxxxx"}'
Confidence
91% confidence
Finding
The POST scrape-and-cache example again represents external upload of user-specified URLs with persistent storage. The document's own privacy note makes the risk more concrete: content may be globally cached and visible to other users, so accidental submission of sensitive links can have lasting impact.

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"url": "https://mp.weixin.qq.com/s/xxxxx"}'

# Read cached article (Markdown format)
curl "https://api.readgzh.site/rd?s=article-slug&format=text" \
  -H "Authorization: Bearer <YOUR_API_KEY>"

# Paginated reading (part 2 of long article)
Confidence
85% confidence
Finding
Fetching cached content from the third-party service remains an external transmission that can disclose request patterns and contextual identifiers. Even when content is already cached, the agent still relies on and shares data with an outside provider.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer <YOUR_API_KEY>"

# Paginated reading (part 2 of long article)
curl "https://api.readgzh.site/rd?s=article-slug&part=2" \
  -H "Authorization: Bearer <YOUR_API_KEY>"

# AI summary (Pro only)
Confidence
84% confidence
Finding
Chunked retrieval increases the volume of untrusted external content entering the agent context and can amplify prompt-injection or instruction-confusion risk if article text is treated as authoritative. The transmission itself is expected behavior, but in a skill context it is still a real security boundary crossing.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "Authorization: Bearer <YOUR_API_KEY>"

# AI summary (Pro only)
curl "https://api.readgzh.site/rd?s=article-slug&mode=summary" \
  -H "Authorization: Bearer <YOUR_API_KEY>"
```
Confidence
87% confidence
Finding
Remote summary generation extends the trust boundary further by depending on third-party processing and potentially exposing more contextual information. This is especially sensitive if users assume analysis happens locally or if summaries are used in downstream decision-making without provenance checks.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.