T03 · Remote Payload Retrieval and Execution
Error
- Location
references/scripts.md:8- Finding
Unpinned Remote Installer Executed Directly Through Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
阿淼发公众号
Security checks for vulnerabilities and agentic risk
Overview
This WeChat publishing skill is mostly coherent, but it needs review because it can publish or save content to an external account while also using unsafe runtime installation paths and optional no-confirm publishing.
Review this skill before installing. Keep final publish confirmation enabled, avoid Turbo/no-confirm mode for live accounts, install Bun through a trusted pinned process instead of `npx -y` or `curl | bash`, and store WeChat secrets outside project directories with strict permissions or a credential manager.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
references/scripts.md:3- Finding
Automatic Execution of an Unpinned npm Package Through npx
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (37)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description emphasizes a publishing skill that posts content to a WeChat Official Account, including article and image-text publishing workflows. The actual code chunk does not publish anything, does not interact with WeChat APIs or a browser, and does not process content beyond declaring an intended conversion purpose in comments. At runtime it simply prints an error and exits. Even considering the comments, the script's stated purpose is conversion to WeChat-ready HTML without publishing, which is materially different from the declared primary purpose of publishing to WeChat. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a functioning WeChat Official Account publishing skill. However, the actual executable behavior of the provided code chunk is just a stub: it emits two error messages and terminates. While comments describe intended publishing features, comments are not runtime behavior. Therefore the supplied code materially fails to match the declared primary purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents a functioning WeChat Official Account publishing skill with multiple content modes and publishing paths. However, the provided code chunk contains no publishing logic, no browser automation, no API interaction, no content transformation, and no image-text handling. It only outputs a message that the full runtime is required and terminates. This is a material description-behavior mismatch because the primary declared purpose is not carried out by the supplied code at all.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Parallel side-computation in editorial pass - Industry terminology protection via config - Domain-specific AI-tone signal suppression - Access token cache with auto-refresh - Image source resolution with graceful fallback - version: 2.1.0 changes:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `references/fsm.md` — Full FSM state table
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `references/fsm.md` — Full FSM state table
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill specifies local access-token cache files in predictable locations without documenting protections such as restricted permissions, encryption, OS keychain storage, or avoidance of workspace exposure. Cached API tokens for a publishing account can be stolen by other local processes, included in backups, or accidentally committed if stored in project directories, enabling unauthorized publication.
- Content
md --- ## Access Token Cache Cache location (in priority order): `amiao/.wechat-token-cache` → `~/amiao/.wechat-token-cache`
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md If `confirm_before_publish: false` and no warnings: skip confirmation, show summary inline in completion report instead.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` is the primary agent contract; keep it self-contained and readable
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md → ACTION: halt + request cover image (LEVEL 3) STATE: pre_publish_confirm → confirm_before_publish: false AND no warnings → skip confirmation UI → STATE: publishing → confirm_before_publish: true OR any warnings present
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
curl -fsSL https://bun.sh/install | bashdownloads a remote script and immediately executes it in the shell, which is a classic unsafe installation pattern. If the remote source, transport path, DNS, or hosting account is compromised, arbitrary code can run on the user's machine.- Content
- Neither → halt + explain:
text Bun runtime required. Install: curl -fsSL https://bun.sh/install | bash Or via npm: npm install -g bun
- Neither → halt + explain:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The
| bashconstruct directly chains fetched content into shell execution, removing any opportunity for review and amplifying the risk of remote code execution. In the context of a skill intended for end users to follow, this materially increases the chance that users will execute untrusted code without validation.- Content
- Neither → halt + explain:
text Bun runtime required. Install: curl -fsSL https://bun.sh/install | bash Or via npm: npm install -g bun
- Neither → halt + explain:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 74% confidence
- Finding
Mentioning an access token cache indicates credentials may be stored locally for reuse, which creates exposure if the cache is persisted insecurely or shared across accounts/users. In a content-publishing skill, cached API tokens could let an attacker publish unauthorized content or access account capabilities if the host is compromised.
- Content
md | Comment control | ✗ | ✓ | ✗ | | Requires Chrome | ✓ | ✗ | ✓ | | Requires API credentials | ✗ | ✓ | ✗ | | Access token cache | — | ✓ | — | | Speed | Medium | Fast | Slow |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Error | Auto-action | |-------|-------------| | Access token expired | Refresh token from AppID/AppSecret, update cache, retry | | Transient network error (timeout, 5xx) | Wait 3s, retry; wait 10s, retry again | | WeChat API rate limit (temporary) | Wait 10s, retry once |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Error | Auto-action | |-------|-------------| | Access token expired | Refresh token from AppID/AppSecret, update cache, retry | | Transient network error (timeout, 5xx) | Wait 3s, retry; wait 10s, retry again | | WeChat API rate limit (temporary) | Wait 10s, retry once |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 3. Copy AppID and AppSecret Where to save: A) Project-level: amiao/.env B) User-level: ~/amiao/.env Format:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 3. Copy AppID and AppSecret Where to save: A) Project-level: amiao/.env B) User-level: ~/amiao/.env Format:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 3. Copy AppID and AppSecret Where to save: A) Project-level: amiao/.env B) User-level: ~/amiao/.env Format:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list is broad and includes vague phrases like 'or similar', increasing the chance the skill activates on ordinary conversational requests. Because the skill can lead to external publishing actions, over-broad activation raises the risk of unintended invocation and downstream unauthorized or accidental posting behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The skill metadata allows runtime fallback to
npx, which fetches and executes packages without a pinned version. That creates a supply-chain risk: a compromised or newly published package version could be executed in the agent environment unexpectedly.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Turbo mode explicitly skips pre-publish confirmation and auto-proceeds to publishing. For a skill that performs an external side effect against a real account, removing the human confirmation gate materially increases the risk of accidental publication, prompt-triggered abuse, or misuse from ambiguous user instructions.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The workflow allows skipping user confirmation and proceeding with publication when configuration disables confirmation and no warnings are detected. Autonomous execution of an external publishing action is dangerous because configuration mistakes, prompt injection, or false-negative warning logic can cause unauthorized posting to a live WeChat account.
- Content
确认发布？(y/n / 输入 e 返回编辑)
text If `confirm_before_publish: false` and no warnings: skip confirmation, show summary inline in completion report instead. ---
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The documented runtime fallback
npx -y bunwill download and run the latest resolved Bun package at execution time. In an automated publishing skill, that exposes the environment to unreviewed upstream changes or package compromise, which is a realistic supply-chain execution risk.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instructions require 'Natural Chinese phrasing' and alignment with 'likely WeChat search intent,' which imposes a specific language/locale expectation in natural-language guidance. The document does not indicate this is optional or user-selected, nor does it provide an opt-in or alternative language path.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The FSM allows publishing to proceed without a confirmation UI when configuration disables confirmation and no warnings are present. Because publishing is an external side effect that can affect a real WeChat account, skipping an explicit final consent step increases the risk of unintended or premature publication caused by misclassification, content errors, or account-selection mistakes.
- Content
md STATE: pre_publish_confirm → confirm_before_publish: false AND no warnings → skip confirmation UI → STATE: publishing → confirm_before_publish: true OR any warnings present → ACTION: show_confirmation_summary (see SKILL.md format)