WeChat Article Video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 2.1.0

Overview

Review recommended: the skill’s video workflow is coherent, but it runs an unpinned external CLI and has weak asset path validation that could expose files outside the project.

Install only if you are comfortable running video-generation tooling in a contained project workspace. Pin or preinstall HyperFrames instead of allowing ad hoc `npx` downloads, and avoid using untrusted storyboard files until asset paths are constrained to the project directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:172

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/validate_storyboard.py:161

Finding

Storyboard Asset Validation Allows Paths Outside the Project Root

Content

View full analysis

Remediation

View remediation

Path: supplied = Path(value) if supplied.is_absolute(): raise ValueError("asset path must be relative") candidate = (root / supplied).resolve(strict=True) if not candidate.is_relative_to(root): raise ValueError("asset path escapes project root") if not candidate.is_file(): raise ValueError("asset path is not a regular file") return candidate ``` 3. Apply the same helper consistently to `focal_asset` and every `secondary_assets` entry. 4. Treat symlink escapes as invalid by checking containment after canonical resolution. 5. Restrict accepted assets to an intended directory such as `source/images/` rather than the entire project root. 6. Enforce an allowlist of supported media extensions and validate actual decoded file types instead of relying only on filenames. 7. Add regression tests covering: - `../` traversal - Absolute paths - Nested traversal - Symlinks targeting external files - Valid files inside the approved asset directory ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes an end-to-end article/image-to-video generation skill for WeChat Channels. The supplied code chunk only implements a contact-sheet generator for an already existing video, using ffprobe/ffmpeg and PIL to sample frames and compose a labeled image grid. This is materially different from the declared primary purpose and omits nearly all advertised capabilities. While such a tool could support QA in a broader video workflow, on its own it does not match the claimed skill behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs file reads, file writes, and shell execution but does not declare any explicit tool scope or allowed-tools boundary. In an agent runtime, that increases the chance of over-broad tool access, making unintended filesystem or command execution possible if article content, filenames, or surrounding context are adversarial.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx hyperframes without a pinned version allows whatever package version is current at execution time to be fetched and run. This creates a supply-chain risk where a compromised, malicious, or simply breaking upstream release could execute arbitrary code in the agent environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The default prompt is written as an English instruction ('Use $wechat-article-video to turn this WeChat article...') with no indication that the user can choose language or locale. Because this skill targets WeChat content and the surrounding metadata is Chinese, hard-coding an English interaction pattern may violate a language/locale policy requiring user choice or explicit justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Line L125 states 'Use spoken Chinese' as a blanket instruction. This is a natural-language locale constraint, and the file does not provide user opt-in, alternative language handling, or a clear documented justification that the skill is region- or language-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Line L120 explicitly instructs handling of long Chinese names, and the example asset metadata at L129 uses Chinese text, indicating a Chinese-language assumption. Because this markdown file does not document that the skill is region-specific or offer a language/locale choice, it appears to impose a locale-specific content policy by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example hard-codes zh-CN-XiaoxiaoNeural, which specifies a Chinese locale and voice. This appears to impose a specific language/locale in the skill guidance without stating that users can choose another locale or that the schema is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script defaults to zh-CN-XiaoxiaoNeural, which hard-codes a Chinese locale/voice selection in user-facing behavior. This is a natural-language locale policy concern because the file does not indicate that the user is choosing this language or that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_contact_sheet.py (reported line 30)May include surrounding context.

python

def probe_duration(video: Path) -> float:
    result = subprocess.run(
        [
            "ffprobe",
            "-v",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_contact_sheet.py (reported line 68)May include surrounding context.

python

def extract_frame(video: Path, timestamp: float, destination: Path) -> None:
    subprocess.run(
        [
            "ffmpeg",
            "-y",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/qa_video.py (reported line 17)May include surrounding context.

python

def probe(video: Path) -> dict:
    result = subprocess.run(
        [
            "ffprobe",
            "-v",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/qa_video.py (reported line 47)May include surrounding context.

python

def extract_first_frame(video: Path, destination: Path) -> dict:
    destination.parent.mkdir(parents=True, exist_ok=True)
    subprocess.run(
        [
            "ffmpeg",
            "-y",

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction "Default to Chinese" imposes a specific language behavior in the skill’s natural-language policy surface. The file does not offer a user language choice or explain that the skill is restricted to a China-only or Chinese-only compliance context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The ffmpeg invocation uses the -y flag, which forces overwrite of the destination cover file if it already exists. Although the script later prints overall results, there is no prior confirmation prompt or explicit user-facing warning near the destructive write behavior itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script creates parent directories and writes the report file unconditionally, which can overwrite an existing report path. There is no confirmation prompt or inline warning around this file write, and the top-level docstring does not disclose the write behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.