Security audit

微信公众号自动发布

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated WeChat publishing purpose, but it can post publicly and reuse stored login cookies with weak safeguards.

Review carefully before installing. Use `--draft` first, avoid unattended cron publishing unless you fully control the machine and account, protect or delete `~/.wechat_mp/cookies.json` as a sensitive login session, and do not publish article files from untrusted sources until the HTML insertion is escaped or sanitized.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Warning

Location: README.md:190
Finding: Persistent Unattended Publishing Through a Cron Job
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/publish.py:23
Finding: Reusable Authentication Cookies Stored Without Explicit Permission Hardening
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/publish.py:86
Finding: Unescaped Article Content Injected into an Authenticated Page Through innerHTML
Content: View full analysis
') continue # Detect numbered heading lines. if line and line[0] in "①②③④⑤⑥⑦⑧⑨": html_parts.append( f'
{line}
' ) else: html_parts.append( f'
{line}
' ) return "\n".join(html_parts) ``` ```python html_content = build_html_content(content) # Clear the editor and inject HTML. page.evaluate("""(html) => { const ed = document.querySelector('.ProseMirror'); if (ed) { ed.innerHTML = html; ed.dispatchEvent(new Event('input', {bubbles:true})); } }""", html_content) ``` Comments and the docstring have been translated into English; the vulnerable data flow is unchanged. ### Technical Analysis The command-line argument and `--content-file` input are documented as plain text. However, each input line is interpolated directly into an HTML string without entity encoding or sanitization. The resulting string is then assigned to the editor's `innerHTML`. Characters such as `<`, `>`, `"`, and `&` therefore retain HTML semantics. A crafted input can terminate the intended paragraph structure and inject arbitrary elements or attributes. Depending on the target page's Content Security Policy and browser behavior, active constr ...[truncated 1796 chars]
Remediation: View remediation
' f'{safe_line}' ) ``` 8. A safer browser-side design is: ```javascript const paragraph = document.createElement("p"); paragraph.textContent = untrustedLine; ed.appendChild(paragraph); ``` 9. Treat article files from external sources as untrusted even when they use a `.txt` or `.md` extension. ]]>

T08 · Insecure Dependencies

Note

Location: scripts/requirements.txt:1
Finding: Unbounded Playwright Dependency Without Integrity Pinning
Content: View full analysis
=1.40.0 ``` Related installation guidance in `overview.md` also uses: ```bash pip3 install playwright ``` ### Technical Analysis The requirement accepts every Playwright release from version 1.40.0 onward. It does not specify an audited exact version, an upper bound, or package hashes. As a result, installations performed at different times can resolve to materially different dependency code than the version reviewed during this audit. Playwright operates with the user's local permissions, launches browsers, and processes sensitive authenticated browser state. A compromised upstream release, compromised package-index account, dependency substitution caused by unsafe index configuration, or unexpectedly incompatible future version would execute in a security-sensitive context. No evidence was found that the current package name is a typosquat or that Playwright itself is malicious. The finding concerns non-reproducible and integrity-unverified dependency resolution. ### Attack Path 1. A user installs the project dependencies at a later date. 2. The package resolver selects the newest version satisfying `>=1.40.0`. 3. The selected package or a transitive dependency differs from the version originally reviewed. 4. If that package is compromised, malicious installation-time or runtime code executes with the user's permissions. 5. The code may access files available to the user, including the stored WeChat cookies, and may interfere with browser automation. ### Impact Assessment A successful supply-chain compromise could execute arbitrary Python code with the privileges of the user installing or running the Skill. This would potentially expose local files, authentication cookies, article content, and the authenticated publishing session. The observed project ...[truncated 168 chars]
Remediation: View remediation
=`. 2. Generate a lock file containing cryptographic hashes for Playwright and its transitive Python dependencies. 3. Install with hash enforcement, such as `pip install --require-hashes -r requirements.txt`. 4. Use the official Python package index over TLS and avoid untrusted additional indexes. 5. Perform dependency updates through an explicit review process. 6. Run vulnerability and provenance checks before accepting a new version. 7. Install into an isolated virtual environment without administrator privileges. 8. Document and pin the compatible Playwright browser build as part of a reproducible installation procedure. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 126)May include surrounding context.
Q: 如何清除登录状态？

A: 删除 Cookie 文件后重新登录：

bash
rm ~/.wechat_mp/cookies.json python3 publish.py --login

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
md
- **保存位置**：`~/.wechat_mp/cookies.json` - **有效期**：通常 30 天左右 - **过期处理**：自动跳转登录，用微信重新扫码 - **清除**：`rm ~/.wechat_mp/cookies.json` 后重新 `--login` ## 故障排查

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README states that login cookies are automatically saved to ~/.wechat_mp/cookies.json but does not warn that these cookies are sensitive session credentials. If another local user, backup system, or malware accesses that file, an attacker may be able to reuse the session to control the associated WeChat public account.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly instructs users to publish articles directly and later recommends batch and scheduled publishing, but it does not clearly warn that omitting --draft will cause an immediate public post. In an automation skill that targets a real publishing platform, lack of an irreversible-action warning materially increases the risk of accidental publication, reputational harm, and unintended disclosure.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 195)May include surrounding context.
编辑 crontab：

bash
crontab -e

添加定时任务（每天下午 3 点发布）：

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill automates drafting or directly publishing content to a public WeChat official account, but the description does not prominently warn users that running it can cause immediate public-facing actions. In an automation context, omission of this warning increases the risk of accidental publication, reputational harm, and unintended disclosure if the user invokes the skill with real account credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation states that authentication cookies are saved and reused from ~/.wechat_mp/cookies.json, but it does not provide a clear security warning about the sensitivity of that file. Persistent session cookies can allow account takeover by any local user, malware, backup system, or process that gains read access to the file.
Content: No source excerpt is available for this finding.

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.
md
**Q: 第一次运行总是要登录？** A: 首次登录后 Cookie 会保存到 `~/.wechat_mp/cookies.json`，后续会自动使用。如果还是提示登录，检查： - Cookie 文件是否存在：`ls -l ~/.wechat_mp/cookies.json` - 文件是否可读：`cat ~/.wechat_mp/cookies.json` - 尝试重新登录：`python3 publish.py --login`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation promotes direct publication and cookie reuse for a real account-impacting workflow without clearly warning that persisted session cookies are sensitive credentials and that automation can publish content on behalf of the user. In this context, copying the script across machines and reusing login state increases the chance of accidental account misuse, session leakage, or unauthorized publishing if the cookie store is exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script persists authenticated WeChat MP session cookies to a predictable file in the user's home directory without any permission hardening, encryption, or explicit warning. If another local user, malware, backups, or a compromised process can read this file, the session may be replayed to access and publish from the associated account.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The natural-language instructions throughout the file are exclusively in Chinese, and the README does not indicate that the skill is limited to Chinese-speaking users or provide an alternative language option. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 73% confidence
Finding: The file consistently presents the skill entirely in Chinese and targets a Chinese-platform workflow, but it does not state that the locale is intentionally restricted or provide an opt-in language choice. Under the policy, forcing a specific language without user choice can be a natural-language policy concern unless the locale constraint is explicit and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The editor URL includes lang=zh_CN, which forces a specific language/locale behavior. There is no visible user opt-in, configuration flag, or justification that this skill is intentionally limited to a Chinese locale only.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency is specified with a lower-bound version only, which allows future unreviewed Playwright releases to be installed. This can introduce supply-chain instability or unexpected breaking or vulnerable versions over time, reducing reproducibility and making builds harder to audit.
Content: Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.
text
playwright>=1.40.0

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T06 · System Persistence

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tool Parameter Abuse

Q: 如何清除登录状态？

Tool Parameter Abuse

Missing User Warnings

Missing User Warnings

Session Persistence

Missing User Warnings

Missing User Warnings

File System Enumeration

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Unpinned Dependencies

Static analysis