WhatsApp样式工具-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.1

Overview

The skill is mainly a WhatsApp text-formatting guide, but it asks for broad execution/write authority and contains inconsistent network and script-execution instructions.

Review this before installing. The core text-formatting guidance is benign, but only use it in an environment where command execution, file writes, and outbound network callbacks are not automatically granted. Do not run the documented validator command unless the validator script is supplied from a trusted path, and avoid providing callback URLs unless the skill is revised to clearly define and limit what is sent.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:45

Finding

Excessive Tool Permissions for a Text-Formatting Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:45-48
Vulnerability Type: Excessive command-execution and filesystem permissions
Risk Level: Medium

Vulnerable configuration:

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The Skill's stated purpose is to format and validate WhatsApp-compatible text. These operations can be completed in memory and do not inherently require arbitrary command execution or filesystem modification.

Declaring both exec and write violates the principle of least privilege. If the hosting Agent automatically grants the declared tools, malicious or prompt-injected input processed while this Skill is active could attempt to induce command execution or unauthorized file modification. The declaration does not impose command allowlists, path restrictions, confirmation requirements, or output controls.

Attack Path

1. A user submits attacker-controlled text for formatting.
2. The text contains prompt-injection content directing the Agent to invoke the declared exec or write tool.
3. The hosting Agent treats those tools as authorized because the Skill declares them.
4. If the Agent does not independently enforce tool restrictions, it executes a system command or writes to an accessible file.
5. The attacker obtains capabilities beyond those required for text formatting.

Exploitation depends on the hosting Agent granting these tools and failing to reject instructions embedded in untrusted content.

Impact Assessment

Successful exploitation could permit command execution with the Agent process's operating-system privileges or modification of files writable by that process. The potential scope includes project files, user-owned files, and accessible runtime configuration. The declaration alone does not establish that exploitation has occurred, but it unnecessarily increases the consequence of prompt injection.

Remediation

View remediation

Remediation Suggestions

• Remove exec and write from the declared tools.
• Perform formatting and validation entirely in the model context or through a narrowly scoped formatting API.
• If file output is an essential feature, replace unrestricted writes with a dedicated operation restricted to a user-selected output file.
• If command execution is retained, use a fixed executable and fixed arguments rather than a general shell.
• Require explicit user confirmation before any filesystem modification or process execution.
• Treat all text submitted for formatting as untrusted data rather than executable Agent instructions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:298

Finding

Execution of an Unbundled Script Through a Relative Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:298
Vulnerability Type: Ambiguous local script resolution
Risk Level: Medium

Vulnerable command:

bash

python3 validate_whatsapp_style.py --input message.txt

Technical Analysis

The project contains only SKILL.md; the referenced validate_whatsapp_style.py script is not included. Python therefore resolves the relative script name from the process's current working directory.

If the documented command is executed in a directory containing an attacker-controlled file with that name, Python will execute the attacker-controlled script. No absolute or Skill-relative path, integrity verification, trusted-directory check, or bundled implementation protects script resolution.

Although this is presented as a usage example rather than code that automatically executes, it creates an unsafe documented execution path when followed by an Agent or user.

Attack Path

1. An attacker obtains write access to the directory from which the validation command will run, or persuades the user or Agent to operate in an attacker-controlled project.
2. The attacker creates validate_whatsapp_style.py containing malicious Python code.
3. The user asks the Skill to perform command-line validation, or the Agent follows the documented command.
4. Python resolves the relative filename to the attacker's file.
5. The malicious script executes with the privileges and environment of the invoking Agent or user.

Impact Assessment

Successful exploitation provides arbitrary Python code execution with the invoking process's privileges. The malicious script could read accessible files, modify project data, invoke subprocesses, or access environment variables. The practical scope is limited by operating-system permissions and any sandbox imposed by the Agent platform.

Remediation

View remediation

Remediation Suggestions

• Include the validator implementation in the reviewed Skill package.
• Resolve it from a verified Skill installation directory rather than the current working directory.
• Invoke Python without shell interpolation and pass user input only as a discrete argument.
• Verify the bundled script's integrity before execution where the platform supports integrity checks.
• Alternatively, remove the command entirely and implement validation using the documented in-memory regular-expression logic.
• Update installation and usage instructions so users are never expected to execute an unidentified same-named file from an arbitrary directory.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:98

Finding

Unrestricted Callback URL Conflicts with the Local-Only Security Model

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:98
Vulnerability Type: Unrestricted outbound callback destination
Risk Level: Medium

Vulnerable interface definition, translated from the source documentation:

text

| callback_url | string | No | Callback notification URL after asynchronous processing |

The contradictory runtime claim appears at SKILL.md:442:

text

Runtime mode: Pure local processing, no network requests

Technical Analysis

The documented input accepts an arbitrary callback URL, but the Skill also claims that processing is local and performs no network requests. The document provides no URL validation, protocol restriction, destination allowlist, private-network protection, redirect policy, authentication policy, or definition of the information sent in a callback.

If an Agent implements the callback literally, an attacker could provide an external collection endpoint and cause processed content to leave the local environment. A callback implementation that permits internal addresses could also introduce server-side request forgery behavior. No callback implementation exists in the audited package, so the risk is conditional on an Agent acting on the documented interface.

Attack Path

1. An attacker supplies formatting input with a callback_url under the attacker's control, or points it to an internal service.
2. The Agent interprets the documented parameter as authorization to perform an asynchronous callback.
3. The Agent sends status data, formatted content, logs, or another request to the supplied URL.
4. For an external destination, the attacker receives data and request metadata.
5. For an internal destination, the request may reach services that are inaccessible to the attacker directly.

Impact Assessment

Potential impact includes disclosure of formatted messages, processing logs, internal addressing information, callback credentials, or netwo ...[truncated 248 chars]

Remediation

View remediation

Remediation Suggestions

• Remove callback_url because asynchronous network callbacks are unnecessary for local text formatting.
• If callbacks are a genuine requirement, clearly revise the local-only claim and require explicit user consent before transmission.
• Permit only HTTPS URLs and apply an allowlist of trusted destinations.
• Reject loopback, link-local, private, multicast, metadata-service, and otherwise non-public addresses after every DNS resolution.
• Disable redirects or revalidate every redirect destination.
• Define and minimize the callback payload; do not include message contents or logs by default.
• Apply timeouts, response-size limits, authentication controls, and audit logging.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:451

Finding

Unnecessary Network Probing Guidance in a Local Formatting Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:451
Vulnerability Type: Unnecessary network diagnostic command execution
Risk Level: Low

Documented guidance, translated from the source documentation:

text

Network error: Execute a ping command to test network connectivity, inspect firewall
and proxy settings, and execute the command again.

Technical Analysis

The error-handling section directs the Agent to execute ping even though the Skill describes its formatting and validation operations as local and states that they make no network requests. Network connectivity is therefore unrelated to the stated core operation.

The instruction unnecessarily expands the Skill's behavioral scope from text processing to network probing. It does not specify a fixed destination, prohibit user-controlled command fragments, or require confirmation. While a fixed and safely invoked ping is normally a low-risk diagnostic operation, an Agent that constructs a shell command from attacker-controlled host input could introduce command-injection risk. The document does not provide enough evidence to confirm such interpolation, so that aspect remains conditional.

Attack Path

1. A formatting operation is reported or misclassified as a network error.
2. The Agent follows the Skill's diagnostic guidance.
3. A destination is supplied by the user or inferred from untrusted input.
4. The Agent invokes ping, causing an unnecessary outbound or internal-network probe.
5. If an unsafe shell command is constructed, shell metacharacters in the destination could increase the impact; no such implementation is included in the project.

Impact Assessment

The confirmed impact is unnecessary network activity and expansion beyond the Skill's declared local-only behavior. Depending on destination selection and network access, the operation could disclose that the Agent environment is active or probe reachable internal ho ...[truncated 99 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the network-error row and all ping guidance.
• Handle formatting failures through local input validation and deterministic error messages.
• If network diagnostics are retained for a separate network-dependent feature, require explicit user confirmation and use a dedicated API rather than a shell.
• Restrict destinations to validated hostnames or addresses and pass them as discrete process arguments.
• Document the network behavior accurately instead of claiming that the Skill performs no network requests.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest display name, summary, description, and the rest of the skill instructions are presented only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale limitation is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims it is a local-only tool with no network use, yet its documented interface accepts a callback_url and the error handling section discusses network connectivity checks. This kind of contradiction can mislead users and security reviewers about the actual trust boundary, causing them to permit data exposure or outbound requests they did not expect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The overview says the free version is suitable for basic formatting and that batch format conversion requires upgrading to PRO. Later, the documentation presents a scenario of converting an existing Markdown document into WhatsApp-compatible format, which is described as a bulk/whole-document conversion workflow. This creates a contradiction about whether batch conversion is included in the free edition.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.