Baoyu Post To Wechat

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:13 PM UTC
• Version: 0.1.1

Overview

The skill is a real WeChat publishing helper, but it handles account credentials and runtime execution in ways users should review carefully before installing.

Install only if you are comfortable with a skill that can use WeChat publishing credentials or a logged-in Chrome profile to create drafts. Prefer a preinstalled trusted Bun runtime, avoid `npx -y bun`, keep AppSecrets out of EXTEND.md, store secrets in a protected secret manager or tightly permissioned env file, and use a dedicated WeChat account/profile when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:22

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 22
Vulnerability Type: Supply-chain risk caused by unpinned remote package execution
Risk Level: High

Vulnerable Code

md

**Agent Execution**: Determine this SKILL.md directory as `{baseDir}`, then use `{baseDir}/scripts/<name>.ts`. Resolve `${BUN_X}` runtime: if `bun` installed → `bun`; if `npx` available → `npx -y bun`; else suggest installing bun.

Technical Analysis

The fallback command npx -y bun instructs the Agent to resolve a package from the npm registry, download it, and execute its binary without interactive approval. No version, lockfile, integrity hash, or trusted package source is specified.

Consequently, the executable payload can change after the Skill has been audited. A malicious package release, compromised maintainer account, registry compromise, or unexpected dependency update could cause arbitrary code to run under the Agent user's account.

The -y option suppresses the normal installation confirmation, further reducing the opportunity for the user to review the resolved package and version. This behavior is unnecessary when a trusted Bun installation can instead be required as an explicit prerequisite. It is particularly concerning because the audited artifact does not contain the referenced scripts/ directory, meaning the downloaded runtime cannot successfully execute the declared local scripts as packaged.

Attack Path

1. An attacker compromises the npm package, its maintainer account, or a dependency included in a future package release.
2. A system without a locally installed bun binary loads the Skill.
3. The Skill selects the documented npx -y bun fallback.
4. npx resolves and downloads the current package from the registry without asking for confirmation.
5. The package binary or associated installation code executes with the permissions of the Agent process.
6. Malicious code can access f ...[truncated 832 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the automatic npx -y bun fallback and require a separately installed, trusted Bun runtime.
2. If automatic installation is unavoidable, pin an audited exact version rather than resolving the latest release.
3. Use a lockfile and verify package integrity hashes before execution.
4. Require explicit user confirmation before downloading or executing any package.
5. Obtain packages only from an organization-controlled or otherwise explicitly trusted registry.
6. Document the expected package name, version, publisher, and integrity value so the Agent can validate them.
7. Include the referenced scripts/*.ts files in the distributed artifact and validate their hashes before invoking the runtime.
8. Run the publishing process in a restricted environment with access only to the required article files and selected WeChat credentials.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:118

Finding

WeChat AppSecrets May Be Stored in Plaintext Markdown Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 118-139 and 169-184; references/config/first-time-setup.md, lines 169-183
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: High

Vulnerable Code

SKILL.md permits credentials to be placed directly in an account configuration block:

md

accounts:
  - name: Account One
    alias: baoyu
    default: true
    default_publish_method: api
    default_author: Author
    need_open_comment: 1
    only_fans_can_comment: 0
    app_id: your_wechat_app_id
    app_secret: your_wechat_app_secret

It then assigns inline plaintext configuration the highest credential-resolution priority:

md

### Credential Resolution (API Method)

For a selected account with alias `{alias}`:

1. `app_id` / `app_secret` inline in EXTEND.md account block
2. Env var `WECHAT_{ALIAS}_APP_ID` / `WECHAT_{ALIAS}_APP_SECRET` (alias uppercased, hyphens → underscores)
3. `.baoyu-skills/.env` with prefixed key `WECHAT_{ALIAS}_APP_ID`
4. `~/.baoyu-skills/.env` with prefixed key
5. Fallback to unprefixed `WECHAT_APP_ID` / `WECHAT_APP_SECRET`

The first-time setup reference also provides a plaintext secret field:

md

accounts:
  - name: [display name]
    alias: [short key, e.g. "baoyu"]
    default: true
    default_publish_method: [api/browser]
    default_author: [author name]
    need_open_comment: [1/0]
    only_fans_can_comment: [1/0]
    app_id: [WeChat App ID, optional]
    app_secret: [WeChat App Secret, optional]

Technical Analysis

EXTEND.md is a Markdown preferences file that can be stored either inside the current project or under the user's home directory. The documented multi-account configuration allows a WeChat AppSecret to be embedded directly in this file and gives that source precedence over environment-based credential storage.

Project Markdown files are likely to be committed t ...[truncated 2153 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove app_id and app_secret values from the EXTEND.md schema and examples.
2. Permit configuration files to contain only environment-variable names or references to a credential-store entry.
3. Store AppSecrets in an operating-system keychain, dedicated secret manager, or owner-readable environment file.
4. If a local secret file must be supported, create it with owner-only permissions, such as mode 0600 on Unix-like systems.
5. Add .baoyu-skills/.env and any project-level secret-bearing paths to generated ignore rules.
6. Warn users explicitly never to commit, share, archive, or paste credential files into conversations or logs.
7. Prefer user-level secret storage over project-level plaintext storage.
8. Ensure all command output, error messages, and completion reports redact AppSecrets and access tokens.
9. Validate that credential lookup reads only the exact required keys rather than loading or displaying unrelated secrets.
10. Recommend immediate credential rotation if an AppSecret has previously been stored in a tracked or shared EXTEND.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The skill instructs the agent to resolve WeChat app_id and app_secret from inline config, environment variables, and .env files. Accessing and aggregating credentials is highly sensitive; in a skill that also performs network publication, this increases the risk of secret exposure, misuse, or accidental leakage through logs or downstream tools.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

4. ~/.baoyu-skills/.env with prefixed key
5. Fallback to unprefixed WECHAT_APP_ID / WECHAT_APP_SECRET

.env multi-account example:

bash

# Account: baoyu

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The skill directs checking .env files for WECHAT_APP_ID in project and home directories, which is credential discovery behavior. Even though intended for setup, scanning local secret stores broadens access to sensitive material and can expose users to credential misuse if the agent or surrounding tooling is compromised.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

bash

# macOS, Linux, WSL, Git Bash
test -f .baoyu-skills/.env && grep -q "WECHAT_APP_ID" .baoyu-skills/.env && echo "project"
test -f "$HOME/.baoyu-skills/.env" && grep -q "WECHAT_APP_ID" "$HOME/.baoyu-skills/.env" && echo "user"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The project-level and user-level .env probing is another instance of local credential discovery. Because the skill's purpose includes remote API use, any automatic secret-file access carries elevated risk of unintended disclosure or abuse beyond the immediate task.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

bash

# macOS, Linux, WSL, Git Bash
test -f .baoyu-skills/.env && grep -q "WECHAT_APP_ID" .baoyu-skills/.env && echo "project"
test -f "$HOME/.baoyu-skills/.env" && grep -q "WECHAT_APP_ID" "$HOME/.baoyu-skills/.env" && echo "user"

powershell

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The Windows PowerShell branch performs equivalent .env credential discovery, so the same secret-access concerns apply across platforms. Cross-platform automation of secret lookup makes the behavior more dangerous because it normalizes broad credential access in varied environments.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

powershell

# PowerShell (Windows)
if ((Test-Path .baoyu-skills/.env) -and (Select-String -Quiet -Pattern "WECHAT_APP_ID" .baoyu-skills/.env)) { "project" }
if ((Test-Path "$HOME/.baoyu-skills/.env") -and (Select-String -Quiet -Pattern "WECHAT_APP_ID" "$HOME/.baoyu-skills/.env")) { "user" }

If Credentials Missing - Guide Setup:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The setup flow tells the agent to prompt for AppID and AppSecret and persist them into .env files. Persisting credentials in plaintext in project or home directories creates long-lived secret exposure risk, particularly in shared machines, synced folders, backups, or source-control accidents.

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

3. Copy AppID and AppSecret

Where to save? A) Project-level: .baoyu-skills/.env (this project only) B) User-level: ~/.baoyu-skills/.env (all projects)

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This line continues the instruction to write user-supplied API credentials directly to .env, which is sensitive credential handling. The danger is amplified by the skill's publishing capability, since the same workflow that stores the secret can immediately use it for external API actions.

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

Where to save? A) Project-level: .baoyu-skills/.env (this project only) B) User-level: ~/.baoyu-skills/.env (all projects)

text

After location choice, prompt for values and write to `.env`:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 498)May include surrounding context.

md

| Issue | Solution |
|-------|----------|
| Missing API credentials | Follow guided setup in Step 2 |
| Access token error | Check if API credentials are valid and not expired |
| Not logged in (browser) | First run opens browser - scan QR to log in |
| Chrome not found | Set `WECHAT_BROWSER_CHROME_PATH` env var |
| Title/summary missing | Use auto-generation or provide manually |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description does not clearly warn that article text, metadata, images, and possibly credentials/session-derived actions will be sent to WeChat and drafts may be created in the user's account. In a publishing skill, this omission increases the chance of unintended disclosure or account-side state changes without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The skill permits executing Bun via npx -y bun without pinning a specific version, which can fetch whatever package version is current at execution time. That creates a supply-chain risk and undermines reproducibility, especially because this skill is designed to handle publishing and account credentials.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.

md

### Step 3: Resolve Theme/Color and Validate Metadata

1. **Resolve theme** (first match wins, do NOT ask user if resolved):
   - CLI `--theme` argument
   - EXTEND.md `default_theme` (loaded in Step 0)
   - Fallback: `default`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill is explicitly designed to send article payloads to the WeChat API endpoint, which is an external transmission of user-supplied content and metadata. In context this behavior is expected, but it is still security-relevant because drafts, summaries, covers, and comment settings are transmitted off-host to a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.

md

**CRITICAL**: Always include `--theme` parameter. Never omit it, even if using `default`. Only include `--color` if explicitly set by user or EXTEND.md.

**`draft/add` payload rules**:
- Use endpoint: `POST https://api.weixin.qq.com/cgi-bin/draft/add?access_token=ACCESS_TOKEN`
- `article_type`: `news` (default) or `newspic`
- For `news`, include `thumb_media_id` (cover is required)
- Always resolve and send:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation describes an automated workflow that opens Chrome, pastes rendered content into the WeChat editor, replaces placeholders, and reports the article as composed, but it does not clearly warn users that the skill performs browser automation and publication-oriented edits in a live editor. This can cause users to invoke the skill without understanding that it may modify draft content, interact with an authenticated WeChat session, and potentially publish or prepare content in a sensitive account context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The setup instructs creating and writing EXTEND.md as a persistent preferences file, while nearby documentation later introduces fields for sensitive values like app_secret, but the setup flow provides no warning about secret storage risk. This omission can lead users to treat EXTEND.md as an ordinary config file and store credentials insecurely, increasing the likelihood of leakage via repositories, syncing, or local compromise. Because this skill is specifically designed to interact with WeChat publishing APIs, the chance that users will eventually place real credentials there is substantial.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The multi-account template explicitly supports storing multiple accounts’ app_id and app_secret values in EXTEND.md. Putting API credentials in a general markdown configuration file increases the risk of accidental disclosure through source control, backups, shared workspaces, or overly broad file access, especially because the same file also supports user-scoped storage under the home directory. In the context of a publishing skill, credential handling is expected, but documenting plaintext credential storage makes the design more dangerous than necessary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest describes a skill for posting content to a WeChat Official Account, but this setup flow adds broader preference-management capabilities such as choosing project-vs-user persistence scope and storing a Chrome profile path. While some defaults are operationally useful, managing cross-project preference storage and browser profile configuration is not directly implied by the narrow act of posting content itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.