T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/get_access_token.sh:33- Finding
WeChat AppSecret Exposed in Process Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
wechat mp draft
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a straightforward WeChat draft helper, but it handles powerful account credentials and access tokens in ways that can expose them locally.
Review this before installing if the WeChat account matters. Use it only in a trusted local environment, avoid shell history or process telemetry that records command lines, restrict any credential file permissions, rotate secrets if exposed, and confirm article content and image paths before running the upload or draft scripts.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/upload_image.sh:8- Finding
WeChat Access Token Exposed During Image Upload
- Content
View full analysis
<图片路径> ``` ### Technical Analysis The script accepts the access token as its first positional argument. Consequently, the token can appear in the shell's process invocation for `upload_image.sh`. It is then interpolated into the URL passed to `curl`, exposing it again in the child process command line. A local user or monitoring component with permission to inspect process metadata could capture the token during either stage. The request uses HTTPS and the official WeChat domain, so this is a local secret-handling weakness rather than network plaintext transmission. ### Attack Path 1. An authorized user invokes `upload_image.sh` with a valid access token as the first argument. 2. The token appears in the script process's argument vector. 3. The script expands the same token into the `curl` URL. 4. A local observer, process monitor, audit service, or privileged container/host operator records either command line. 5. The observer extracts the token before its expiration. 6. The observer reuses it to call WeChat APIs permitted by that token and subject to applicable upstream controls. ### Impact Assessment An exposed access token can permit unauthorized API calls until the token expires or is invalidated. The exact privileges depend on the WeChat account and token permissions, but may include uploading permanent materials and performing other enabled account-management operations. Unlike a ...[truncated 167 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/add_draft.sh:7- Finding
WeChat Access Token Exposed During Draft Creation
- Content
View full analysis
<标题> [作者] [摘要] ``` ### Technical Analysis The draft-creation script obtains the access token from `$1`, making it visible in the script's process arguments. It subsequently interpolates the token into the URL supplied to `curl`, creating a second command-line exposure. Process arguments may be accessible to local users under permissive process-inspection settings and are routinely collected by some audit, monitoring, and orchestration systems. TLS does not address disclosure occurring before the request leaves the local system. ### Attack Path 1. An authorized user invokes `add_draft.sh` with a valid token. 2. The token is placed in the script's argument vector. 3. The token is expanded into the URL used to launch `curl`. 4. An observer with access to process metadata or command telemetry captures the token. 5. The observer reuses the token while it remains valid. 6. The observer invokes authorized WeChat APIs, potentially creating or modifying account resources within the token's permission scope. ### Impact Assessment Token theft may allow unauthorized creation of WeChat drafts and other API actions enabled for the associated account. This can affect content integrity and permit misuse of account resources. The impact window is limited by token expiration or invalidation, while the available operations remai ...[truncated 79 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明的核心用途是撰写微信公众号文章并保存到草稿箱，但提供的代码片段仅是一个配置模板与操作说明，作用是让用户配置微信公众号 API 凭证（AppID、AppSecret）和 IP 白名单。该代码没有展示任何与文章内容生成、素材组装、调用微信草稿接口、上传草稿或发布相关的实现，因此其实际行为与声明用途存在明显不一致，属于实质性目的不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是内容创作并保存到微信公众号草稿箱的能力，但代码片段实际只实现了认证准备步骤：读取配置中的 AppID/AppSecret，向微信 token 接口请求 access_token，并处理错误情况。这属于微信公众号 API 鉴权/凭证获取功能，而不是文章代写或草稿保存功能。虽然获取 token 可能是后续发布草稿的支持步骤，但当前代码块本身没有任何文章内容处理、草稿箱接口调用、媒体上传或草稿创建逻辑，因此与声明的主要用途存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says the skill writes公众号 articles and saves them to the WeChat draft box. The supplied code does neither article generation nor draft creation. Its sole function is uploading an image file to WeChat's permanent material store and obtaining a media_id. While image upload could be a supporting step for article publishing, this chunk's primary purpose is materially different from the declared end-user function, and the described capability is not accurately represented by this code.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill explicitly handles sensitive WeChat credentials and access tokens, which are high-value secrets that can enable content publication and API access if exposed through logs, command output, shell history, or insecure script handling. In an agent setting, token retrieval via shell scripts materially increases the risk of credential leakage or misuse.
- Content
工作流程
1. 获取 Access Token
bash ./scripts/get_access_token.sh
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | 接口 | 路径 | 说明 | |------|------|------| | 获取 Access Token | `/cgi-bin/token` | 获取接口调用凭证 | | 上传永久素材 | `/cgi-bin/material/add_material` | 上传封面图片等素材 | | 新增草稿 | `/cgi-bin/draft/add` | 保存文章到草稿箱 | | 获取草稿列表 | `/cgi-bin/draft/batchget` | 获取草稿列表 |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | 接口 | 路径 | 说明 | |------|------|------| | 获取 Access Token | `/cgi-bin/token` | 获取接口调用凭证 | | 上传永久素材 | `/cgi-bin/material/add_material` | 上传封面图片等素材 | | 新增草稿 | `/cgi-bin/draft/add` | 保存文章到草稿箱 | | 获取草稿列表 | `/cgi-bin/draft/batchget` | 获取草稿列表 |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh #!/bin/bash # 获取微信公众号 Access Token # 使用方法：./get_access_token.sh set -e
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents shell-based execution (
./scripts/...) but does not declare any tool scope such aspermissionsorallowed-tools. This creates an authorization gap where an agent may execute shell commands without explicit user-visible restriction, increasing the chance of unintended command execution or unsafe script use.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrases are broad enough to activate on ordinary requests about WeChat articles, increasing the chance that the skill engages shell/API actions in contexts where the user only wanted advice or editing help. In an agent environment, overbroad invocation can lead to unintended external operations with configured credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents a request that includes
appidandsecretin the query string, which involves sensitive credentials. The surrounding documentation does not warn users not to expose, log, or commit these values, so the description omits a privacy/security warning for credential-handling behavior.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This hardcoded external endpoint causes the skill to send content outside the local environment to the WeChat API. In the context of a skill that drafts and uploads public account articles, this is expected behavior, but it remains security-relevant because any sensitive or regulated content passed to the script will leave the system and be stored by a third party.
- Content
sh }') # 调用 API RESPONSE=$(curl -s -X POST "https://api.weixin.qq.com/cgi-bin/draft/add?access_token=${ACCESS_TOKEN}" \ -H "Content-Type: application/json" \ -d "$JSON")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This hardcoded external endpoint causes the skill to send content outside the local environment to the WeChat API. In the context of a skill that drafts and uploads public account articles, this is expected behavior, but it remains security-relevant because any sensitive or regulated content passed to the script will leave the system and be stored by a third party.
- Content
sh }') # 调用 API RESPONSE=$(curl -s -X POST "https://api.weixin.qq.com/cgi-bin/draft/add?access_token=${ACCESS_TOKEN}" \ -H "Content-Type: application/json" \ -d "$JSON")
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This shell script contains user-facing comments and runtime messages exclusively in Chinese, including usage instructions and error guidance. That forces a specific language/locale without any opt-in or indication that the skill is intentionally limited to Chinese-speaking users, which matches the policy-violation criteria.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md fi # 调用微信 API RESPONSE=$(curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${APPID}&secret=${APPSECRET}") # 检查是否成功 if echo "$RESPONSE" | grep -q '"access_token"'; then
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md fi # 调用微信 API RESPONSE=$(curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${APPID}&secret=${APPSECRET}") # 检查是否成功 if echo "$RESPONSE" | grep -q '"access_token"'; then
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md fi # 调用微信 API RESPONSE=$(curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${APPID}&secret=${APPSECRET}") # 检查是否成功 if echo "$RESPONSE" | grep -q '"access_token"'; then
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md fi # 调用微信 API RESPONSE=$(curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${APPID}&secret=${APPSECRET}") # 检查是否成功 if echo "$RESPONSE" | grep -q '"access_token"'; then
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi # 调用微信 API RESPONSE=$(curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${APPID}&secret=${APPSECRET}") # 检查是否成功 if echo "$RESPONSE" | grep -q '"access_token"'; then
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh fi # 调用微信 API RESPONSE=$(curl -s "https://api.weixin.qq.com/cgi-bin/token?grant_type=client_credential&appid=${APPID}&secret=${APPSECRET}") # 检查是否成功 if echo "$RESPONSE" | grep -q '"access_token"'; then
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This template forces a single language for all instructions and warnings, which may violate language or locale policy when users are not given an opt-in or alternative. No text indicates that the skill is region-specific or intentionally limited to Chinese-speaking users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The comments and runtime output strings are written in Chinese throughout the script, which effectively forces a single language for user interaction. There is no indication that the tool is intentionally limited to Chinese-speaking users or that an alternate language is available.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This shell script performs an HTTP upload of a user-supplied file to the WeChat API and includes the access token in the request URL. Although the script logs that an upload is happening, it does not warn the user that local file contents and credentials will be transmitted to an external service.
- Content
Static analysis
No suspicious patterns detected.