Wechat Article Writer Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

This skill is a writing helper, but it asks for command execution and documents running an unbundled local script, so users should review it before installing.

Install only if you are comfortable reviewing or removing the exec permission and avoiding the optional write.py workflow unless the script is supplied from a trusted, fixed path. Do not put real API keys in project config files; use environment variables or a secret manager, and keep generated drafts out of shared repositories if they contain private material.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:194

Finding

Execution of an Unverified Relative Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 194
Vulnerability Type: Execution of an unresolved local script
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: read exec

bash

python3 write.py draft --input topic-card.md -o draft.md

Technical Analysis

The Skill grants command-execution capability and documents execution of write.py through a relative path. The audited project contains only SKILL.md; it does not include or verify the referenced script.

Relative script resolution depends on the Agent's current working directory. If an attacker can place a file named write.py in that directory, the documented command will execute the attacker's code. No fixed Skill-relative path, integrity validation, ownership check, or user confirmation is specified.

The core functionality is described as Markdown-driven article generation, so unrestricted command execution is not necessary for its primary purpose.

Attack Path

1. An attacker gains the ability to create or influence files in the Agent's working directory, shared workspace, or extracted project location.
2. The attacker places a malicious file named write.py in that directory.
3. A user requests the optional scripted workflow described by the Skill.
4. The Agent executes python3 write.py draft --input topic-card.md -o draft.md.
5. Python resolves the relative path to the attacker-controlled script.
6. The script executes with the operating-system privileges and environment access of the Agent process.

Impact Assessment

Successful exploitation provides arbitrary Python code execution under the Agent's account. Depending on that account's permissions, an attacker could read or modify accessible files, obtain environment variables and locally available credentials, alter generated content, invoke network services, or execute additional local commands.

This does not independently provide ...[truncated 151 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec from allowed-tools if the optional script is not required.
• Remove the documented command unless the referenced script is included in the package and receives a separate security review.
• If the script is retained, resolve it from a canonical path rooted in the installed Skill directory rather than the current working directory.
• Verify the resolved path, file ownership, and cryptographic integrity before execution.
• Run the script in a sandbox with minimal filesystem, environment-variable, and network access.
• Require explicit user confirmation before invoking optional executable components.
• Reject symlinks and paths that resolve outside the trusted Skill directory.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:292

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 292
Vulnerability Type: Unpinned package installation
Risk Level: Low

Vulnerable Code

bash

pip install pyyaml

Technical Analysis

The Skill recommends installing PyYAML without specifying an audited version, package hash, locked dependency manifest, or trusted index configuration. The package version selected by this command can therefore change over time.

Python package installation processes package-controlled metadata and installation artifacts. If the upstream package, package-distribution account, configured package index, or network environment is compromised, installation could introduce malicious or incompatible code. The audit found no evidence that PyYAML itself is malicious; the issue is the mutable and insufficiently verified installation process.

Attack Path

1. A user follows the dependency-installation instruction.
2. pip resolves pyyaml using the environment's configured package index and selects the currently available compatible release.
3. A compromised upstream release, malicious index mirror, or altered package artifact is returned.
4. The package is installed into the user's Python environment.
5. Malicious package behavior executes during installation or when the dependency is imported by a later workflow.

Exploitation is conditional on compromise or manipulation of the dependency-distribution channel.

Impact Assessment

A compromised dependency could execute code with the privileges of the user running pip or the application importing the package. Potential scope includes the active Python environment, files accessible to that user, environment variables, application data, and available network resources.

If installation is performed globally or with elevated privileges, the effect could extend to system-wide Python packages. The documentation does not explicitly direct users to install with adm ...[truncated 23 chars]

Remediation

View remediation

Remediation Suggestions

• Avoid the optional dependency if the Markdown-only workflow does not require it.
• Pin PyYAML to a reviewed, compatible version.
• Use a hash-locked requirements file and install with pip install --require-hashes -r requirements.txt.
• Explicitly use the official Python Package Index or an authenticated, controlled internal mirror.
• Install dependencies inside an isolated virtual environment without administrative privileges.
• Add automated vulnerability scanning and a controlled update process for pinned dependencies.
• Document the exact dependency versions supported by the Skill.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:294

Finding

Unsafe Guidance for Storing External Model API Keys

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 294–297
Vulnerability Type: Plaintext credential exposure
Risk Level: Medium

Vulnerable Documentation Excerpt

text

API Key Configuration

The free version uses the Agent's built-in LLM by default and does not require an additional API key.
When using an external writing model such as DeepSeek, set the model API key in the configuration file.

Technical Analysis

The Skill directs users to place an external model API key in a configuration file but does not prescribe environment variables, a secret manager, restrictive permissions, encryption, version-control exclusions, or redaction controls.

Configuration files are commonly copied into repositories, diagnostic archives, backups, and shared workspaces. A plaintext key stored in such a file can consequently become accessible to users or processes that were not intended to receive it.

No hardcoded credential is present in the audited project. The vulnerability is insecure credential-handling guidance that may cause users to create exposed plaintext secrets.

Attack Path

1. A user configures an external writing model according to the documented instruction.
2. The user stores the API key in a plaintext configuration file.
3. The file is committed to version control, included in a backup or support archive, shared with collaborators, or read by another local process.
4. An unauthorized party extracts the key.
5. The party submits requests to the external model provider using the stolen credential until it is revoked or expires.

Impact Assessment

Exposure may permit unauthorized API use within the permissions and quota assigned to the key. Consequences can include financial charges, quota exhaustion, service disruption, access to provider-side resources authorized to that credential, and attribution of abusive requests to the legitimate account.

The precise scope depends on ...[truncated 145 chars]

Remediation

View remediation

Remediation Suggestions

• Store API keys in environment variables or a dedicated operating-system or cloud secret manager.
• Never place real credentials in committed configuration files.
• Provide a configuration template containing only a placeholder or the name of the required environment variable.
• Add secret-bearing local files to .gitignore and document that exclusion explicitly.
• Restrict local secret-file permissions to the owning user if a file is unavoidable.
• Prevent secrets from appearing in logs, generated articles, error messages, command histories, and exported diagnostic data.
• Recommend narrowly scoped keys, usage limits, regular rotation, and immediate revocation after suspected exposure.
• Add automated secret scanning to repository and release workflows.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill requests exec permission even though its narrative claims core functionality is Markdown-driven and does not require command execution. This mismatch expands the agent's authority beyond what users would reasonably expect, increasing the risk that the skill or downstream prompts could invoke local commands or scripts unnecessarily.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill description frames the tool as a lightweight writer for generating and polishing WeChat article drafts. However, the capability sections generically state support for '创建/查询/修改/删除', '导入', '重置', '保存', and '导出', which expands beyond draft writing and conflicts with the later statement that the free version only outputs draft content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill instructs the agent to write output files and mentions external API key configuration without clear warnings about where files are stored, what data may be persisted, or how secrets should be handled. In an agent environment, unclear persistence and credential-handling guidance can lead to accidental disclosure of drafts, sensitive source material, or API keys.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is so broad that it could activate for many ordinary writing or marketing requests, causing this skill to overtake more appropriate workflows. Overbroad activation is dangerous because it increases unintended tool use, file creation, and possible access to exec-enabled behavior in situations where the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.