T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_weixin.py:50- Finding
Unrestricted Browser Navigation Enables Internal Resource Retrieval
- Content
View full analysis
- Remediation
View remediation
Security audit
WeChat Article Fetcher
Security checks for vulnerabilities and agentic risk
Overview
This WeChat article fetcher mostly matches its stated purpose, but it needs review because its script can browse and save content from any supplied URL, not only WeChat links.
Use this only with trusted mp.weixin.qq.com article URLs, preferably in an isolated browser/network environment. Expect it to install browser automation dependencies and to save both article text and a full-page screenshot in the chosen output directory or current working directory.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
scripts/requirements.txt:1- Finding
Unpinned Third-Party Dependency and Mutable Driver Acquisition
- Content
View full analysis
=4.0.0 ``` ### Technical Analysis The dependency constraint permits any DrissionPage release at or above version 4.0.0. Future installations may therefore resolve to code that was not present or reviewed when this Skill was audited. The documentation instructs users to install the requirements using `pip` and states that a matching ChromeDriver is downloaded automatically on first use. This introduces another mutable external component whose exact version and integrity are not controlled by the repository. There is no evidence that the named package or current driver is malicious. The risk arises because later package or driver versions can be selected and executed without a reproducible lock file, exact version constraint, or recorded integrity hash. ### Attack Path 1. A user installs the Skill dependencies at a later date. 2. The package resolver selects a newer DrissionPage release allowed by the open-ended constraint. 3. Installation or import executes third-party package code with the privileges of the user running the Agent. 4. On first execution, the browser automation stack may acquire a matching driver not pinned or verified by this project. 5. If a selected package release, distribution source, or downloaded driver is compromised, malicious code can execute locally. ### Impact Assessment A compromised dependency or driver could execute with the same operating-system privileges as the Agent process. Depending on those privileges, it could read accessible files, access network resources, alter output, or execute arbitrary local actions. No dependency compromise is demonstrated in the audited files, so this is a preventive supply-chain ...[truncated 66 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes a script that writes extracted article content and screenshots to disk, but the manifest declares no explicit tool scope or permissions. This weakens containment and review because consumers cannot easily tell that local file writes are part of the skill's behavior, increasing the chance of unintended data persistence or misuse in broader execution contexts.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill’s stated purpose is extracting WeChat article text, but it also captures and saves a full-page browser screenshot. Screenshots can include more data than the article body alone, such as account state, recommendations, popups, QR codes, or other rendered content, creating unnecessary data collection and persistence beyond the declared function.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill description explains the outputs but does not clearly warn users that article text and screenshots will be saved as local files. This can cause accidental storage of potentially sensitive content on the host system, especially if users assume the action is transient or view-only.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description suggests transient content extraction, but the implementation persistently writes the fetched article to a local Markdown file. This creates unexpected local data retention, which can expose fetched content to other processes or users on the host and may violate least-surprise or data-minimization expectations.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
The dependency is specified with a lower bound only (DrissionPage>=4.0.0), which allows future major or minor releases to be installed without review. This creates supply-chain and stability risk because a malicious or compromised upstream release, or an incompatible breaking change, could be pulled into the skill automatically.
- Content
text DrissionPage>=4.0.0
Static analysis
No suspicious patterns detected.