Security audit
aws-wechat-article-writing
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed WeChat article-drafting workflow that reads/writes local article files and may send configured article content to a user-chosen LLM endpoint.
Before installing, use a dedicated API key, verify config.yaml.writing_model.base_url points to a trusted endpoint, and avoid passing sensitive business documents as references unless you are comfortable sending their contents to that endpoint. The skill is designed to produce drafts, not publish directly, and its publication settings should stay on draft unless you explicitly choose otherwise.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.