Security audit

微信支付接入skill

Security checks across malware telemetry and agentic risk

Overview

This WeChat Pay support skill is purpose-related, but it should be reviewed because it automatically runs a networked update script and can persist role preferences into a project-wide agent file.

Install only if you are comfortable with the skill running a Python updater that downloads and replaces its local documentation, and with its troubleshooting workflow handling payment authorization values for API queries. Prefer running the update script only after explicit review, verify the publisher/source, and avoid letting the skill write to AGENTS.md unless you want that preference to affect future agent sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to read local files, write/update a knowledge base, access the network, and invoke a shell script, yet no explicit permissions or user disclosure are declared. In a payment-related skill, these capabilities materially expand the attack surface because a compromised or modified sync/update path could alter local content or execute unintended commands under the agent's privileges.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to ask for consent and then write merchant-role preferences into the project-root AGENTS.md. That expands the skill from read-only documentation lookup into persistent modification of repository state, which is not necessary for answering WeChat Pay questions and can create cross-session state manipulation or unintended policy changes.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill requires reading AGENTS.md to derive behavior and potentially modifying it later, giving a domain-specific support skill influence over a project-wide control file. This creates an unnecessary trust boundary violation: untrusted user input about merchant identity can affect future agent behavior outside the narrow WeChat Pay retrieval task.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The instruction to run a local sync script when document loading fails causes code execution on the host without any user-facing warning, consent, or description of network/filesystem effects. Because the script updates documentation content, it could fetch untrusted or changed remote data and alter the local environment in a way the user did not request.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill mandates immediate execution of a local update script on load, before any user interaction, document read, or safety check. This is especially dangerous because it creates automatic shell execution plus network/file modification behavior merely by selecting the skill, which is disproportionate to the user's intent and could be abused through a tampered script or supply-chain compromise.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/APIv3接口动态排障.md:131