Wechat Mp Fetch

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 1.1.1

Overview

This skill mostly does what it claims, but it needs review because weak URL checks can let a supplied link make the local browser visit unintended sites or private network addresses.

Review before installing in environments with private services or sensitive network access. Use only trusted WeChat article URLs, avoid running it on untrusted links, and prefer pinned dependency installation from a registry you trust. Also use fetched article content only where you have permission to archive or repurpose it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/validator.js:10

Finding

Insufficient URL Validation Permits Unintended Network Access

Content

View full analysis

!document.URL.includes('login') && document.readyState === 'complete', { timeout: timeout / 2 } ); ``` ### Technical Analysis The URL allowlist is implemented by searching the entire URL string for `mp.weixin.qq.com` and `/s/`. These checks do not establish that the parsed destination hostname is actually `mp.weixin.qq.com`. An attacker can place the expected domain text in the URL user-information component while selecting another host as the actual destination. For example: ```text http://mp.weixin.qq.com@127.0.0.1/s/test ``` This value is syntactically valid, contains both required substrings, and therefore passes `validateUrlFormat()` and `validateWeChatUrl()`. However, its actual hostname is `127.0.0.1`. The implementation also allows Playwright to follow redirects without validating each redirect target or the final hostname. Consequently, even an initially valid WeChat URL could redirect the browser to an unintended destination. Because the destination is opened in a full browser, the loaded page can execute JavaScript and generate additional network requests. No request inte ...[truncated 1783 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package-lock.json:16

Finding

Dependency Lockfile Uses a Third-Party Package Registry Mirror

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A second independent mismatch report also indicates the skill's declared functionality is inconsistent with the actual implementation, specifically claiming article retrieval and extraction without corresponding browser automation or network handling. In security terms, misleading documentation reduces auditability and can mask unexpected execution paths or hidden functionality, especially in a tool that asks users to install and run code locally.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A second independent mismatch report also indicates the skill's declared functionality is inconsistent with the actual implementation, specifically claiming article retrieval and extraction without corresponding browser automation or network handling. In security terms, misleading documentation reduces auditability and can mask unexpected execution paths or hidden functionality, especially in a tool that asks users to install and run code locally.

Content

No source excerpt is available for this finding.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · OPTIMIZATION.md (reported line 171)May include surrounding context.

md

.option('-u, --url <url>', 'WeChat article URL')
  .option('-f, --format <format>', 'Output format (json, markdown)', 'json')
  .option('-t, --timeout <ms>', 'Timeout in milliseconds', '30000')
  .option('-d, --debug', 'Enable debug mode')
  .parse(process.argv);

const options = program.opts();

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · README.md (reported line 83)May include surrounding context.

md

.option('-u, --url <url>', 'WeChat article URL')
  .option('-f, --format <format>', 'Output format (json, markdown)', 'json')
  .option('-t, --timeout <ms>', 'Timeout in milliseconds', '30000')
  .option('-d, --debug', 'Enable debug mode')
  .parse(process.argv);

const options = program.opts();

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · scripts/wx-article-fetch.js (reported line 28)May include surrounding context.

js

.option('-u, --url <url>', 'WeChat article URL')
  .option('-f, --format <format>', 'Output format (json, markdown)', 'json')
  .option('-t, --timeout <ms>', 'Timeout in milliseconds', '30000')
  .option('-d, --debug', 'Enable debug mode')
  .parse(process.argv);

const options = program.opts();

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The installation command uses npx playwright without pinning an exact version, which can fetch whatever version is current at execution time. That creates a supply-chain risk: users may install unexpected code or behavior changes, and a compromised or malicious upstream release would be executed locally during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file explicitly promotes archival, batch collection, note-taking, and content repurposing of WeChat articles, which can affect user data handling and third-party content rights. Although the README discusses technical privacy, it does not warn users about responsible use or potential policy/legal considerations when collecting and reusing article content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json

"license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "playwright": "^1.59.1",
    "commander": "^12.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json

"type": "commonjs",
  "dependencies": {
    "playwright": "^1.59.1",
    "commander": "^12.0.0"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language comments exclusively in Chinese, including the module description and method documentation. The policy requires avoiding forced language or locale constraints unless the skill offers user choice or clearly documents a justified region-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JavaScript file contains natural-language comments and function descriptions exclusively in Chinese, which can impose a language constraint on maintainers or users without offering a choice. The policy allows fixed locale only when clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code file contains natural-language documentation entirely in Chinese, including user-facing descriptions of module behavior and parameters. Under the policy rule for language/locale, a forced language without opt-in or justification can be a policy violation, and no alternative language choice or region-specific rationale is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This file’s natural-language content is entirely in Chinese, including the module description and function documentation, with no indication that the skill is intentionally region-specific or that users can choose another language. Under the policy, forcing a specific language without opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.