Security audit

aws-wechat-article-writing-free

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed WeChat article-drafting skill with some documentation inconsistencies, but no artifact-backed malicious behavior.

Before installing, treat this as a Chinese WeChat drafting helper. Use a dedicated API key, configure only a trusted LLM endpoint, and avoid feeding confidential topic-card or article files unless you are comfortable sending them to that endpoint. Expect only drafting/rewrite output, not publishing, tracking, or image-placeholder management.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill name, summary, and repeated description explicitly position the skill as producing WeChat public-account long-form articles, and the instructions consistently prescribe that output as the expected mode of operation. There is no indication that users may choose another language or locale, nor any documented opt-in for this language constraint, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description explicitly says the basic edition does not include '配图占位' advanced branches, but L036 states '本技能提供与配图占位等能力'. This is a direct scope mismatch in the skill's own documentation about what the skill is intended to do.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L036 says the skill provides '配图占位等能力', while later sections repeatedly state the basic edition does not include image placeholders or related advanced branches. This is an active contradiction within the file's own intent documentation, not merely an omission.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The quick-start instructions say to invoke the skill in an AI Agent conversation and provide necessary input parameters, but they do not define concrete trigger phrases, activation boundaries, or negative examples. For a markdown skill description, this ambiguity can cause unintended invocation because the conditions for when the skill should activate versus not activate are not clearly scoped.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The table lists automation/time savings for '文章发布' and '文章跟踪与优化', but elsewhere the file states this skill only produces 'draft.md' and that publishing is out of scope. This creates a documentation-level contradiction about intended capabilities.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.