Security audit

wechat-feige-formatter

Security checks across malware telemetry and agentic risk

Overview

This looks like a WeChat article formatter, but it needs Review because its reported runtime behavior can read local image paths and generate active HTML beyond a simple static conversion.

Install only if you intend to use it for WeChat/public-account article formatting. Avoid running it on untrusted Markdown, especially content with image links to local paths, and review generated HTML before opening or sharing it because it may contain embedded local data and active copy-related script.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to read local files, write temporary Markdown, and generate output HTML, but it does not declare corresponding permissions or clearly scope those file operations. This creates a capability/consent mismatch: users and the platform may not realize the skill can access local paths and persist transformed content, increasing the risk of unintended file access or data exposure.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The formatter trusts Markdown image paths and, by default, reads any local file path referenced by the input, base64-encodes it, and inserts the contents into output HTML. In an agent setting where untrusted user content is transformed automatically, this creates a local file disclosure primitive: an attacker can submit Markdown referencing sensitive local files and cause the tool to exfiltrate their contents into the generated HTML or downstream clipboard/export flows.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The formatter emits HTML containing active JavaScript that invokes clipboard APIs and falls back to document.execCommand('copy'). Because the generated page also embeds unescaped user-controlled article content into the DOM, opening the output executes script-capable content in a browser context, expanding the skill from passive formatting into active behavior and increasing the blast radius of any HTML/script injection.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Clipboard-writing behavior is unrelated to Markdown-to-HTML conversion and introduces active client-side capabilities into content that users may trust as a static document. In this skill context, that is more dangerous because the output is meant for publication/copy-paste workflows, so embedded script can run when previewed locally or shared internally, surprising users and enabling abuse when combined with unescaped content.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The invocation example "我有篇文章要排版，可以帮我优化吗？" is broad and resembles ordinary writing-assistance requests rather than a tightly scoped formatter trigger. In an auto-matching environment, this can cause the skill to activate on general content-editing conversations, increasing the chance of unintended prompt takeover of unrelated user content or over-application of transformation rules.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The statement that OpenClaw will "自动检测匹配本 Skill" describes implicit activation without specifying hard boundaries or required conditions. Ambiguous auto-selection is dangerous because it lets a content-rewriting skill engage on loosely related requests, potentially causing unintended content transformation, instruction interference, or incorrect handling of user files.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The listed examples like "帮我排版这篇文章" and "优化我的 Markdown 文档" are generic requests that overlap with many non-WeChat editing tasks. Because this skill performs AI-driven optimization in addition to formatting, broad triggers expand its reach into normal drafting/editing workflows and raise the risk of unintended activation and content manipulation.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger guidance is broad enough to match common requests such as '帮我排版', '生成 HTML', or generic formatting asks, which can cause the skill to activate in situations where the user did not intend local-file reading or file generation. Over-broad activation increases the chance of unnecessary processing of sensitive content and accidental invocation of file operations.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly accepts local file paths and uploaded content, then reads, restructures, and writes new output files, but it does not prominently warn users that their files will be accessed and converted. In this context, the omission is meaningful because the workflow includes local file ingestion, temporary file creation, and HTML generation, all of which may expose sensitive document contents or create lingering artifacts.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.