Security audit

wechat-feige-formatter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate WeChat article formatter, but its generated HTML can carry unsafe script content and one bundled formatter can inline arbitrary local files into the output.

Review before installing. Use it only on articles and images you trust, avoid formatting untrusted Markdown, and do not allow it to read arbitrary local paths or image references containing private files. The publisher should sanitize generated HTML and restrict or disable local image embedding by default.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/formatter.py:601
Finding: Stored HTML and JavaScript Injection in Generated Documents
Content: View full analysis
str: """Process inline Markdown formatting.""" text = re.sub( r'==(.+?)==', rf'\1', text ) text = re.sub( r'`([^`]+)`', r'\1', text ) text = re.sub( r'\*\*(.+?)\*\*', r'\1', text ) text = re.sub( r'\*(.+?)\*', r'\1', text ) text = re.sub( r'~~(.+?)~~', r'\1', text ) text = re.sub( r'\[(.+?)\]$(.+?)$', r'\1', text ) return text ``` The resulting value is inserted directly into the output document: ```python elif line.strip(): html_pa ...[truncated 3812 chars]
Remediation: View remediation
` tags, SVG payloads, event handlers, quote-breaking image values, `javascript:` links, and encoded scheme variants. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: formatter.py:739
Finding: Arbitrary Local File Disclosure Through Image Embedding
Content: View full analysis
str: """Render an image, embedding local files as Base64 when enabled.""" import base64, mimetypes match = re.match(r'!\[(.*?)\]$(.*?)$', markdown_line) if match: alt_text = match.group(1) src = match.group(2) if ( self.embed_images and not src.startswith('http://') and not src.startswith('https://') ): local_path = Path(src) if not local_path.is_absolute(): local_path = Path.cwd() / local_path if local_path.exists(): mime, _ = mimetypes.guess_type(str(local_path)) mime = mime or 'image/jpeg' with open(local_path, 'rb') as f: b64 = base64.b64encode(f.read()).decode('utf-8') src = f"data:{mime};base64,{b64}" html = f"""
${alt_text}$
""" return html return '' ``` ### Technical Analysis The root formatter accepts an image path directly from Markdown and opens that path with the formatter process’s privileges. Absolute paths are accepted, while relative paths are resolved against the current working directory. The implementation only checks whether the path exists. It does not enforce any of the following: - Restriction to an approved article-assets directory - Path traversal prevention - Regular-file verification - Symbolic-link restrictions - Actual image-format validation - File-size limits - Explicit user confirmation for indivi ...[truncated 2310 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill description promises broad formatting of arbitrary article content, but the workflow also accepts local file paths, reads referenced local images, and produces a full interactive HTML page. This mismatch can mislead users and policy layers about the actual data access and output behavior, which is dangerous because hidden local-read and embedding behavior may expose sensitive files or produce unexpected active content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README states that OpenClaw will automatically detect and match the skill, but does not define clear activation boundaries. Ambiguous auto-matching increases the chance that unrelated Markdown editing or generic writing requests get routed through a skill that rewrites content and emits final HTML.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger examples are broad conversational phrases like asking for help with formatting, which can overlap with ordinary writing-assistance requests. This can cause the skill to activate when the user did not clearly intend HTML/publication formatting, leading to unintended transformation of content and reduced user control.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to read and write local files, but it does not declare any explicit tool scope or permissions boundaries. That makes the file access capability implicit and harder to govern, increasing the chance of unintended local file access or misuse when the skill is invoked.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The invocation description includes broad phrases like “帮我排版”, “转成公众号格式”, and especially “生成 HTML”, which can occur in many unrelated contexts. The trigger guidance does not clearly constrain when this skill should activate versus when another formatting or HTML-related skill should be used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly accepts a local file path as input without any user-facing warning or confirmation step. In an agent context, that is dangerous because it can be used to read arbitrary local files the user did not intend to expose, especially when trigger phrases are broad and the skill claims to accept 'anything'.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Automatic base64 embedding of local images can silently ingest and inline local image contents into the output HTML. This creates privacy and data-volume risks: sensitive local images may be copied into the deliverable, and large embedded assets can cause unexpectedly oversized outputs or downstream sharing of private data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The formatter processes untrusted Markdown and, when it encounters image syntax with a non-HTTP source, reads the referenced local file from disk and embeds its contents into the generated HTML as base64. That creates an arbitrary local file read/exfiltration primitive: a user can submit Markdown referencing sensitive local files, and the resulting HTML or copied content can expose their contents if the file exists and is treated as embeddable data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a formatting/conversion tool that takes article content and produces WeChat-ready HTML. In addition to rendering HTML, the code injects JavaScript for clipboard access and a fixed copy button, which changes the output from a pure formatted document into an interactive page with browser-side behavior. That goes beyond the stated conversion scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The generated HTML hard-codes lang="zh-CN", which imposes a specific locale on all outputs. In this code file there is no user opt-in, configuration option, or documented region-specific justification for forcing that locale.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The embedded script uses navigator.clipboard.write and a fallback document.execCommand('copy') to copy HTML/plaintext from the page. Clipboard access is a distinct browser capability and is not a direct requirement for transforming article text into公众号 HTML as described in the manifest.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The skill documentation and invocation examples are entirely in Chinese and direct the user to interact using Chinese phrases, but do not offer any language or locale choice. This may violate language/locale policy if users are expected to have an opt-in or alternative language path.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest positions the skill as an article formatter that outputs professional WeChat HTML from draft or Markdown content. The generated output also injects a full toolbar, runtime theme-changing logic, and clipboard-copy scripts, which are UI capabilities not clearly justified by the stated formatting purpose and may not belong in content intended for publication.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.