WeChat Publisher With WeMD Render

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 0.1.0

Overview

This WeChat publishing skill mostly does what it says, but it needs review because first use can fetch and run unpinned third-party build code and it can upload broad local file paths using stored WeChat credentials.

Install only if you are comfortable letting this skill use WeChat publisher credentials, upload local files referenced by article inputs, and run a first-use Node/GitHub build process. Keep article assets in a dedicated directory, review or pin the WeMD setup path before use, and require explicit confirmation before publishing, deleting, or uploading any unexpected local file.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _install_npm() -> str | None:
    if NODE_MODULES.is_dir():
        return None
    r = subprocess.run(
        ["npm", "install", "--omit=dev", "--no-audit", "--no-fund"],
        cwd=str(WEMD_DIR), capture_output=True, text=True, timeout=120,
    )

• Confidence: 91% confidence
• Finding: This code automatically runs `npm install` in a bundled dependency directory, which executes package lifecycle scripts and fetches code from the network. Even though the command is hardcoded and not shell-injected, it creates a real supply-chain and arbitrary code execution risk if dependencies are compromised or the package lock is untrusted.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

with tempfile.TemporaryDirectory() as tmpdir:
        tmp = Path(tmpdir)
        r = subprocess.run(
            ["git", "clone", "--depth", "1", WEMD_REPO, str(tmp / "WeMD")],
            capture_output=True, text=True, timeout=60,
        )

• Confidence: 95% confidence
• Finding: The script clones a remote GitHub repository at setup time and then later builds code from it. Pulling and executing build steps from a live external repository without pinning to a reviewed commit exposes the host to supply-chain compromise if the repo, account, or transport trust is abused.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return f"git clone failed: {r.stderr.strip()[:300]}"

        core_dir = tmp / "WeMD" / "packages" / "core"
        r = subprocess.run(
            ["npm", "install", "--no-audit", "--no-fund"],
            cwd=str(core_dir), capture_output=True, text=True, timeout=120,
        )

• Confidence: 94% confidence
• Finding: Running `npm install` inside the freshly cloned repository executes third-party package installation and potentially lifecycle scripts from untrusted remote content. This is a practical arbitrary code execution vector in the context of setup automation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if r.returncode != 0:
            return f"core npm install failed: {r.stderr.strip()[:300]}"

        r = subprocess.run(
            ["npx", "--yes", "typescript", "--build"],
            cwd=str(core_dir), capture_output=True, text=True, timeout=60,
        )

• Confidence: 89% confidence
• Finding: This command executes `npx --yes typescript --build`, which may download and run tooling depending on environment state. Combined with a remote-cloned repo, it expands the supply-chain attack surface and results in execution of code not shipped with the skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)
        if r.returncode != 0:
            tsc_bin = core_dir / "node_modules" / ".bin" / "tsc"
            r = subprocess.run(
                [str(tsc_bin)] if tsc_bin.is_file() else ["npx", "tsc"],
                cwd=str(core_dir), capture_output=True, text=True, timeout=60,
            )

• Confidence: 90% confidence
• Finding: The fallback executes either a local `tsc` binary from installed node modules or `npx tsc`, both of which run code obtained from prior dependency installation steps. Because the preceding steps pull remote content, this continues the chain of untrusted code execution during setup.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and instructs use of shell, filesystem, environment, and network-capable scripts but declares no permissions, preventing informed policy enforcement and user review. In this context, the risk is amplified because the workflow includes dependency installation, local file access, image upload, and remote API interaction, all of which can materially affect the host and external accounts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill description understates its effective behavior: beyond article publishing, it can install/build third-party tooling from a remote repository, persist and delete local theme files, and exposes destructive deletion capabilities. This mismatch is dangerous because operators may authorize the skill for a limited publishing use case while it performs broader supply-chain, local persistence, and destructive actions they did not expect.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The client exposes destructive operations for deleting drafts, published articles, and materials, but the skill metadata only describes creation, update, publishing, and querying capabilities. In an agent setting, undocumented destructive actions materially expand the tool's authority and increase the risk of accidental or unauthorized content deletion.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Local image paths embedded in article HTML are automatically resolved and uploaded through a network helper, which can exfiltrate local files from the host if untrusted content controls img src values. In this skill context, article bodies may be agent- or user-supplied, so auto-uploading referenced files without an explicit allowlist or confirmation increases the risk of unintended disclosure of sensitive local data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The setup routine performs network access, package installation, repository cloning, and compilation automatically with no user-facing warning or confirmation. In an agent skill context, silent environment mutation is risky because users may not expect the skill to fetch and execute external code simply to render or publish content.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This script takes a user-specified local file path and uploads the file to WeChat as permanent material without any in-code confirmation, policy check, or warning that data is leaving the local environment. In an agentic workflow, that creates a real exfiltration risk if the agent is tricked into supplying sensitive files or if file paths are influenced by untrusted input.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code loads app credentials from environment variables and uses them to authenticate to the WeChat API without any user-visible disclosure or consent boundary. In an agent workflow, hidden use of privileged credentials can cause users to trigger actions under a publisher account they may not realize is being used.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The multipart upload helper reads arbitrary local files and transmits their raw contents to a remote WeChat API. In an agent environment, this is a sensitive exfiltration primitive because a user or prompt could cause unintended upload of local files beyond intended image assets.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.